1

I read a lot of article stating that basic authentication + SSL is the way to go over Digest Authentication.

I was thinking of:

  1. client request the login form
  2. server sends back the login form with nonce
  3. client use the nonce to encrypt username + password and sends over SSL

With my basic reading and understanding, I see it more secure because I add a layer of security in case SSL is breached. Or is it not?

Improve this question

1 Answer 1

Reset to default
2

This does not protect against a breach of SSL. If an attacker can breach the SSL connection he can read both the nonce send from the server and the encrypted password and can thus decrypt the password. Even if it is not encrypted but hashed together with the nonce (as done usually in digest authentication) the attacker could simply replace the script used for encryption to leak the password because this script is sent by the server too inside the breached SSL connection.

Apart from not protecting against a breach of SSL this proposal (and also digest authentication) also needs the password to be stored in clear text (or equivalent) at the server for comparison. This actually makes the system less secure in case of a server hack than the usual systems where the password is stored as a one-way hash.

Improve this answer
3
  • hmm so sending username+pw over SSL is the best approach so far? (in terms of sending password), i was just really thinking of additional layer of security in case SSL is breached
    – letthefireflieslive
    Sep 1, 2016 at 4:03
  • Even if you encrypt the username and password and send that over SSL, you have to send how to decrypt it over SSL, and if SSL is being intercepted by a rouge party they can decrypt the username and password. Sending the username and password over SSL is already encrypting it, and the only parties that can decrypt a SSL session (if its not being broken in some capacity), is the client and the server. What you describe wouldn't be adding any additional security to SSL, if it did, then it would be the SOP
    – Ramhound
    Sep 1, 2016 at 4:09
  • 1
    @fireflieslive: doing defense in depth is a good idea but you should take care that it does not actually decrease the security. In this case you've decreased the security a lot on the server side (storing of plain text passwords instead of one way hash) in the (failed) attempt to increase the security of the transport.
    – Steffen Ullrich
    Sep 1, 2016 at 4:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .