Hacker News new | ask | show | jobs
by vijayaggarwal 4379 days ago
According to RFC 2617[1], Both Digest and Basic Authentication are very much on the weak end of the security strength spectrum.

[1]: http://tools.ietf.org/html/rfc2617#section-4.4

2 comments

The main criticism relates to eavesdropping. Wrapping Basic or Digest authentication in TLS eliminates that issue.
The article makes no mention of TLS anywhere, and the example endpoints are all HTTP. So, this is a thoroughly insecure implementation, relying on very weak security mechanisms, prone to straightforward interception and tampering, replay etc.
Both HTTP Basic and Token Authentication are secure when used over HTTPS. I updated the article to include a note about this as well as updated the code examples to use HTTPS.
HTTPS is only secure if no client credentials are stored on the client, e.g. hard coding a username/password pair in a mobile app. If a user needs to supply a username and password it would be OK I guess..