3 ms·
> Does even anybody remember the good old HTTP basic acess authentification? Yes! It was great! People would just transmit username and password in plaintext!
by groby_b 7y ago
> Does even anybody remember the good old HTTP basic acess authentification?
Yes! It was great! People would just transmit username and password in plaintext!
Wait. That's actually the opposite of great. That's why nobody uses it any more.
And no, handycapped people aren't excluded just because something doesn't degrade gracefully into a no-JS environment. You can (and many people do) make perfectly accessible web sites that still require JS.
As for offloading captchas to the client? That suffers a similar problem to basic auth - it's extremely vulnerable because attackers can obtain access to information that makes their job trivial. That's why we cannot "come up with a standard" - the client has to be treated as hostile, because there's no way to verify their integrity.
- messe 7y ago> Yes! It was great! People would just transmit username and password in plaintext! > Wait. That's actually the opposite of great. That's why nobody uses it any more. Unless of course, if you're using HTTPS, in which case HTTP basic auth is fine and very simple to configure for many use cases.
- smacktoward 7y agoYeah, I'm kind of surprised that the age of HTTPS-All-The-Things hasn't led to a resurgence in the use of Basic Auth. As you note, the security problems that have been the big knock on Basic Auth for decades are completely obviated if your whole site is served over HTTPS. My guess on the reason why is two-fold. First, we've been telling people that Basic Auth is a terrible thing only stupid people would use for more than two decades now, and once a lesson like that gets hammered deep enough into the mass consciousness it tends to stay there even long after the underlying facts have changed. And second, using Basic Auth means giving up any possibility of styling/designing your login experience and relying instead on the browser's built-in dialogs, which tend to be clunky and ugly in the extreme.
- organsnyder 7y agoThe UX for basic auth is terrible on most browsers. In Firefox, the dialog box refuses to give up focus, preventing me from copying the password from my password manager (which, while integrated into the browser, doesn't support filling basic auth dialogs).
- smacktoward 7y agoI've had reasonably good experiences with filling out Basic Auth dialogs in Firefox via KeePassXC/KeePassXC-Browser. But by "reasonably good" I mean that it works, the password gets filled in, but the whole experience is still more clunky and error-prone than filling in an HTML login form would be. So yeah, lots of room for improvement here.
- groby_b 7y agoIt's still a security risk. MITM happens regularly. Which means you better constrain it to either low-risk auth, or to networks you completely control. For further risks, see e.g. https://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https https://security.stackexchange.com/questions/988/is-basic-au... Yes, it's simple. And you're trading off security for simplicity. Make that choice, maybe, for your Intranet or your small blog. Commercial sites that have stored PII really, REALLY shouldn't.
- c22 7y agoI think any thorough investigation will conclude that there is, in fact, no way to securely authenticate a web user over unencrypted http.