47

As outlined in the bug report, the issue is that an authentication dialog shows up on trustworthy.com, so oblivious users (and let's be honest, many users who pay attention as well) will type in their username and password, not realizing they're actually sending it to malicious.com. Combine this with a very similar looking domain (e.g. trustw0rthy.com), and ...


2

Like a normal (not same-site) cookie the Authorization header for Basic Authentication is always send with a normal HTTP request when the site is accessed and credentials are known, no matter if cross-site or not. There is no way to specify a different policy for this header.


2

The credentials are not part of the DNS query so they are not visible there. The credentials are included in the encrypted part of HTTPS so that the ISP cannot see these either.


1

I can think of three points: You must use HTTPS, or password will be sent in plaintext. But you need HTTPS for all authentication so this is not specific to basic auth. (I wouldn't really care about the fact that the password hits the network multiple times instead of once. Either you use HTTPS, and then it is fine, or you don't, and then just sending it ...


1

Using Basic Authentication over HTTPS is considered to be secure as the main issue with Basic Authentication is that the credentials are sent over clear text. However, there are some common practices that make using Basic Authentication a bad idea. The following are some examples: Usually no request limiting is put in place - This can allow brute force ...


Only top voted, non community-wiki answers of a minimum length are eligible