3 ms·

It's still a security risk. MITM happens regularly. Which means you better constrain it to either low-risk auth, or to networks you completely control. For fur

It's still a security risk. MITM happens regularly. Which means you better constrain it to either low-risk auth, or to networks you completely control. For further risks, see e.g. https://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https https://security.stackexchange.com/questions/988/is-basic-au... Yes, it's simple. And you're trading off security for simplicity. Make that choice, maybe, for your Intranet or your small blog. Commercial sites that have stored PII really, REALLY shouldn't.

messe 7y ago
Thanks for the link, it's a good summary of the trade offs.
ori_b 7y ago
> It's still a security risk. MITM happens regularly. Then it's more or less as broken as alternative authentication methods
- groby_b 7y ago
  Nope. Because other methods never transmit a password in cleartext. (And they especially don't transmit it with every single request)
  - c22 7y ago
    How do they manage this feat over unencrypted stateless http? Surely they must transmit something with every request?