I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe enough. So, for more security, should I use basic authentication with SSL or digest authentication with SSL?

  • 1
    Dr. Jimbob's answer (the 2nd) is the best way to go, if you have the choice. This does look like a duplicate. I think the other question to ask is: if MD5 is less safe than bCrypt, is it less safe in a way that matters practically holding all other things equal - assuming the only difference is basic+bCrypt vs. http-digest+MD5? – Andrew Philips Nov 12 '15 at 2:00

Basic authentication - is login and password encoded by BASE64 function. Almost same as if you transfer tham in plain-text.

Digest - based on md5 function. It's will not give password to leak.

Allways prefer to use Digest over Basic authentification


https://en.wikipedia.org/wiki/Basic_access_authentication https://en.wikipedia.org/wiki/Digest_access_authentication

| improve this answer | |
  • 1
    Be careful to store the MD5 hash of the user's password with at least the same security as the password itself. MD5 sucks, treat it like plaintext. I'd go so far as to advocate using just Basic authentication, simply because all Digest buys you is a false sense of security and collision attacks. – Reid Rankin Nov 13 '15 at 2:28
  • You just forgot to salt it. – andrey--k Nov 16 '15 at 15:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.