If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server?
If this is the case, isn't it possible to sniff the packets and get the credentials?
2
-
Does it support Digest Authentication?– Neil McGuiganCommented Feb 13, 2016 at 2:06
-
1See also: security.stackexchange.com/q/23561/33 . Not exactly a duplicate, since that one asks the same question but over SSL/TLS, but it is very closely connected. That said, I think the answer here is fairly obvious to you, since you've asked the question...– AviD ♦Commented Feb 14, 2016 at 10:16
Add a comment
|
2 Answers
It depends on the kind of authorization request by the proxy. If this is Basic Authentication the username are passwords are transferred in mostly clear (i.e. base64) and thus can be extracted by passively sniffing the connection. This is no longer true with Digest Authentication or NTLM, although in the latter case there are other attacks to reuse the authentication information.
answered Feb 13, 2016 at 7:07
-
3It is also not resilient against active man in the middle attacks...– AviD ♦Commented Feb 14, 2016 at 10:14
It depends on how the proxy server is authenticating .
If the server authenticates on hash then while sending password/username a hashed value will be sent to the server.
Server will than check the hashed value base on your username & password . In this case you will be a bit safe (with strong username and password).
In case it directly uses the password corresponding to a username. Than definitely your password and Username can be sniffed out.
So i feel totally depends on the design and the implementation.
-
2Even if you use hashes (I am assuming you actually mean Digest authentication?), it does not protect you against active man in the middle attacks.– AviD ♦Commented Feb 14, 2016 at 10:15
-
Ya it won't be able to protect you from mitm attacks....but the mitm attacker also won't be able to generate your username and password!! Commented Feb 14, 2016 at 13:21
-
4