0

So I'm making a portfolio site with a blog which is accessed via a different URL slug and I'm wondering if using basic HTTP auth is enough for security on this website as I will be the only person capable of logging in to the website.

The website will be using HTTPS if HTTP is not secure enough for basic HTTP auth.

Improve this question
4
  • 1
    What are you protecting against?
    – Neil Smithline
    Dec 13, 2015 at 23:46
  • If you are the only one who needs to access the website. Why is it a website? The raison d'etre of a website is that it gives EVERYONE access.
    – Aron
    Dec 14, 2015 at 1:47
  • 1
    If you're using HTTPS then it's secure. HTTP auth has mainly usability problems, like no "logout" functionality and different browsers having different policies on for how long they cache the password, but HTTPS ensures it's just as secure as a standard login form for example, as the data is encrypted over the wire anyway.
    – André Borie
    Dec 14, 2015 at 9:35
  • @AndréBorie - if you make that an answer I'll upvote it.
    – Neil Smithline
    Dec 14, 2015 at 16:45

1 Answer 1

Reset to default
0

If your the only person accessing the website then it's only network you access the website need to be secure. For example, let's say you only operate this blog from your home network. If your home network was compromised by an hacker and they was ARP spoofing on network to capture your credentials or had control over your router to log packets.

I'd recommend you also (if you're not already doing so) is hash your password client side using javascript / jQuery before sending it accross the network. You could also throw an handshake on there to make it harder to compromise too.

If you want to go for a step futher on tighting up the security:

  1. Client request login page
  2. Server gives them login page with handshake key
  3. Client hashes the password and does password then appends handshake key and hashes that.
  4. Server get password from DB which is hashed and handshake key and ensure that is valid before processing it. Ensure the handshake key isn't managed by the client.
  5. If handshake passwords, compare password to DB password.

This would prevent hacker if someone compromised the local network and got your hashed password they wouldn't able to login to your account since they wouldn't know the password for the handshake.

Improve this answer
6
  • 4
    Pass the hash solutions reduce security. This is bad.
    – Neil Smithline
    Dec 14, 2015 at 1:24
  • It obscures the plain-text password so could you elaborate on why it reduces the security?
    – Paul
    Dec 14, 2015 at 11:20
  • 1
    Pass the hash (Wiki article) is a vulnerability where an attacker only needs to know the hash, not the actual password, to execute a successful attack. In your solution, if someone gets the hash out of the DB, they can authenticate with it. The point of hashing passwords in the DB is to protect the password should the DB data be stolen and not to protect the password in transit. That's what SSL is for.
    – Neil Smithline
    Dec 14, 2015 at 16:42
  • If you read my suggestion isn't just hash and send value. Pass the hash is higher security than using plain-text. Also, if I've added a randomly generated handshake value so they can't just login just knowing the hash value. Of course SSL does provide an extra layer of security. You could also hash the password once reaching server for additional security layer but when do you decide to stop of security layers? You could go into much more in-depth security measures.
    – Paul
    Dec 14, 2015 at 16:54
  • Perhaps I'm not understanding your answer. Doesn't I'd recommend you also (if you're not already doing so) is hash your password client side using javascript / jQuery before sending it accross the network. say that you should just pass the hash?
    – Neil Smithline
    Dec 14, 2015 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .