4 ms·
HTTP Basic Auth over a secure transport (i.e., TLS) is not a "security issue".
by c0l0 5y ago
HTTP Basic Auth over a secure transport (i.e., TLS) is not a "security issue".
- qbasic_forever 5y agoIt's a massive footgun and no sane security review would let a production service pass with HTTP basic auth. You're one misconfigured TLS proxy away from major security breaches and issues.
- Spivak 5y agoUhhh what? Do you think either * basic auth only exists at the proxy layer to protect apps with no auth. * commonly deployed auth systems are secure without TLS? because both are false. Check out the Rails Devise support for HTTP basic auth which is perfectly secure. And check that basically zero auth systems in the wild use PAKE and so are entirely dependent on TLS to secure the password transmission in flight.
- odonnellryan 5y agoI hate this argument. I hear it all the time. It's wrong and silly.
- jppittma 5y agoHow many "ands" should a theoretical security threat have before you should just ignore the guy proposing it? E.g. If mercury is in retrograde and the stars are aligned and it's Tuesday and the hacker is in position with Wireshark running on windows XP with a tethered pine phone, and we accidentally open all our ports, then we're completely vulnerable --> Ignore that guy.