I want to know if there are no real advantages of using "auth digest" over SSL, then why facebook and many other famous e-commerce websites and SM platforms still uses it.


Above, the SE community support that there are no real needs for such additional change in security settings. Is there something we have missed?

Should local plan attacks e.g SSLtrip and other MiTM variants can allow attacker to use capture authentication enough for session replay or perhaps brute-force.

Also how can SSL prevent me from brute-forcing basic-auth (SSL) protected website, since the request credentials be same every time, where as with auth digest i will have different value (uri+nonce+credentials+timestamp) so even if session is captured , it won't be replayed (considering low value of nonce.


  • Man-in-the-Middle attacks aren't that easy, especially with how browsers react to set HSTS headers now. But don't take my word for it - set up a VM and try it yourself – MechMK1 Nov 30 '20 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.