views:

65

answers:

3

Using Apache, it is quite simple to set up a page that uses basic access authentication to prompt a user for a name/password and use those credentials in some way to grant access to that user.

Is this secure, assuming the connection between the client and server is secure?

+3  A: 

The worry about basic auth is that the credentials are sent as cleartext and are vulnerable to packet sniffing, if that connection is secured using TLS/SSL then it is as secure as other methods that use encryption.

Chris Diver
A: 

If you are generating passwords with htpasswd consider switching to htdigest.

Digest authentication is secure even over unencrypted connections and its just as easy to set up. Sure, basic authentication is ok when you are going over ssl, but why take the chance when you could just as easily use digest authentication?

jwsample
If it is encrypted then there is no reason to use digest over basic auth, there is no 'chance' being taken. If the connection is not encrypted then digest authentication will prevent revealing the password of the user and it will prevent replay attacks, but the data will be sent in plain text, I would hardly call that 'secure even over unencrypted connections'.
Chris Diver
The "chance" is more like a misconfigured server allowing someone to access the page unencrypted or a user doing so accidentally. This wasn't a question about whether information is better sent over ssl or in the clear. Basic authentication is at the lowest of the low in terms of password authentication security standards. There is a reason you don't see it much in the wild.
jwsample
+1  A: 

As the name itself implies, 'Basic Authentication' is just basic security mechanism. Don't rely on it to provide you with worry free security.

Using SSL on top of it does makes it bit more secure but there are better mechanisms.

SoftwareGeek
So sending credit card details over SSL is a 'bit more secure' than plain text?
Chris Diver
@Chris Diver - what do you mean?
SoftwareGeek