Linked Questions

26
votes
3answers
11k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
3
votes
0answers
540 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
1answer
114 views

Is it secure to store confidential data on basic HTTPS AUTH? [duplicate]

It's a website backend. Since it will only be accessed by two persons, is there any disadvantage on using basic http auth? The website is under https. edit: as the title points, there's confidential ...
30
votes
9answers
10k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
25
votes
3answers
23k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
7
votes
2answers
4k views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
1
vote
1answer
5k views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
2
votes
3answers
2k views

TLS to secure Basic HTTP Auth

Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks ...
1
vote
0answers
848 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
0
votes
1answer
115 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
2
votes
1answer
89 views

Password sent over TLS: threats other than TLS compromise?

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional ...