Re: HTTP AUTH BASIC monowall.

["Dave Korn" <davek_throwaway () hotmail com>]

Simon Smith wrote:
> List,
>    Does anyone else feel that using HTTP BASIC AUTH for a firewall is
> a bad idea even if it is SSL'd. All basic auth does is creates a hash
> string for username:password using base64. That can easily be reversed
> and the real username and password extracted. Sure it's SSL but can't
> a crafty attacker just create a proxy of sorts on a compromised
> network and intercept the communications? Am I missing something here?

  Several things.

  Probably most important of all is that this authentication only travels 
between you and your local network firewall.  Any attacker would have to be 
/inside/ your firewall already to MITM you.  And you'd have to ignore all 
the warnings from your browser about the invalid SSL certificate.  And 
hashes can't be 'easily' reversed, but then again it's not a hash at all, 
it's just an encoding.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/