Re: Prevent security bypass

[Chris Travers <chris () travelamericas com>]

Hi;

MS-CHAP is vulnerable to a modified replay attack with regard to domain 
login (why Microsoft went to Kerberos in Windows 2000).  However I do 
not think that this sort of attack could work on a public web server. 
Unfortunately Mac and Linux clients won't be able to log into a public 
server is you select this option.

For a public web server I recommend basic (plain text) authentication 
and providing security by using SSL.  

Best Wishes,
Chris Travers


Adam wrote:

> I might be wrong about this but I couldn't find anything on MS' site (who
> can?) but I thought the standard NT challenge response was sent unencrypted.
> If this has changed I'd love to know because t would sure make my life
> easier :)
>
> Adam
>
>