From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,INVALID_MSGID
	autolearn=no autolearn_force=no version=3.4.4
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 107e1d,24d0bc347a68ce10
X-Google-Attributes: gid107e1d,public
X-Google-Thread: 103376,24d0bc347a68ce10
X-Google-Attributes: gid103376,public
From: Tucker Taft <stt@averstar.com>
Subject: Re: ANNOUNCE- AWS - Ada Web Server (v0.3)
Date: 2000/01/20
Message-ID: <38875738.235D4D6F@averstar.com>#1/1
X-Deja-AN: 575369036
Content-Transfer-Encoding: 7bit
References: <862qre$ql1$1@wanadoo.fr> <864hib$50v$1@nnrp1.deja.com>
X-Accept-Language: en
Content-Type: text/plain; charset=us-ascii
X-Complaints-To: usenet@inmet2.burl.averstar.com
X-Trace: inmet2.burl.averstar.com 948393784 3577 141.199.8.164 (20 Jan 2000
 18:43:04 GMT)
Organization: AverStar (formerly Intermetrics)  Burlington, MA  USA
Mime-Version: 1.0
NNTP-Posting-Date: 20 Jan 2000 18:43:04 GMT
Newsgroups: comp.lang.ada,fr.comp.lang.ada
Date: 2000-01-20T18:43:04+00:00
List-Id: <comp.lang.ada>

Ted Dennison wrote:
> 
> In article <862qre$ql1$1@wanadoo.fr>,
>   "Pascal Obry" <p.obry@wanadoo.fr> wrote:
> 
> > BTW, I've been really surprised to found out that the Web "Basic"
> > authentification is not at all secure. This is just a base64 encoded
> > "user:pws" string! Use a base64 decoder (10 lines of Ada see AWS
> > sources) and you get both the user name and the password :)
> 
> I found this little ditty in the Apache FAQ:
> 
> Web authentication passwords (at least for Basic authentication)
> generally fly across the wire, and through intermediate proxy systems,
> in what amounts to plaintext. "O'er the net we go/Caching all the way;/O
> what fun it is to surf/Giving my password away!"
> 
> I think I've seen a longer version somewhere.

This is why before you type your password, you should check that
the page asking for it is using SSL (i.e. "https://...).  SSL hides
your password until it reaches the destination.

> 
> --
> T.E.D.
> 
> http://www.telepath.com/~dennison/Ted/TED.html
> 
> Sent via Deja.com http://www.deja.com/
> Before you buy.

-- 
-Tucker Taft   stt@averstar.com   http://www.averstar.com/~stt/
Technical Director, Distributed IT Solutions  (www.averstar.com/tools)
AverStar (formerly Intermetrics, Inc.)   Burlington, MA  USA