2

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional measures are not necessary, others point some problems as I was told in the comments.

What are the threats which are not mitigated by the TLS? Obviously, the passwords leak if TLS connection is attacked by a man-in-the-middle or compromised otherwise. Anything else?

Improve this question
11
  • 4
    If the connection is encrypted, it's not plaintext;)
    – Tobi Nary
    Apr 1, 2016 at 6:16
  • 1
    An attack to the protocol instead might also be a vulnerability. Look up DROWN for example.
    – Rápli András
    Apr 1, 2016 at 6:20
  • 1
    Is this between a web browser and webserver? If so, there are additional issues on the browser side, as covered here: security.stackexchange.com/q/988/33
    – AviD ♦
    Apr 1, 2016 at 7:00
  • 1
    Why downvoting this ? It's not a great question but it's still a relevant one.
    – Stephane
    Apr 1, 2016 at 7:12
  • @SmokeDispenser: valid note, thanks. Question title updated.
    – Konstantin Shemyak
    Apr 1, 2016 at 7:14

1 Answer 1

Reset to default
2

Is there any other attack vector ...

It depends on the details of your implementation. If you are using a POST request or the common HTTP Authentication you should be fine. But if you are using a GET request to send the password (i.e. form with method=GET or similar) then the password might be kept in log files, HTTP Referer header etc which open up more attack vectors.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .