3 ms·

Any mitigation?

• hannob 5y ago
  I guess if you use lynx to surf to http basic auth URLs you should switch to another browser until a security update is available. But I'm inclined to say while this is an interesting bug I don't think that's an incredibly common scenario. Update: It seems there's a preliminary patch that will not fix http auth URLs, but will prevent the info leak: https://www.openwall.com/lists/oss-security/2021/08/07/7 https://www.openwall.com/lists/oss-security/2021/08/07/7
  • infogulch 5y ago
    Plain auth websites are pretty uncommon these days. That said, if using other authentication methods are annoying or inconvenient in Lynx (I don't know, I've never used it) then there may be some correlation between Lynx users and plain auth websites meaning this could impact a large fraction of Lynx the userbase.
  • tinus_hn 5y ago
    Http basic authentication urls are never secure (that requires https) and are not supported in links by browsers these days.
    • akerl_ 5y ago
      This bug only affects HTTPS basic auth, given that the issue is with SNI (and, of course, that basic auth over HTTP doesn’t have any encryption to leak around).
• kadoban 5y ago
  Don't use urls like https://user:pass@example.com https://user:pass@example.com
• infogulch 5y ago
  This is my understanding from reading the OP. Lynx is a CLI browser and apparently it sends plain-auth credentials in the clear in the SNI/hostname part of the https/tls handshake. I suppose someone forgot that the authority part of a uri has a slot for both userinfo as well as host, and parsed it wrong. [0] As far as mitigations go, I guess any of these would work: don't use Lynx; don't use SNI (???); don't use plain auth. [0]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Syntax https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Sy...