Basic Authentication over HTTP – The Evil • Hacker News Board

Re: Basic Authentication over HTTP – The Evil

#11

Post by Paperweight » Wed, Mar 28, 2018, 4:58 PM UTC

pdyck wrote: post #4

rambojazz wrote: post #2

What a pointless post and sensationalized title. The problem is not Basic Authentication, it's HTTP.

Yeah, it‘s just three paragraphs explaining that HTTP is not encrypted.

Plain HTTP is fine if we send it over an encrypted connection. Hmm... I wonder if we could use TLS for that?

;)

Re: Basic Authentication over HTTP – The Evil

#12

Post by amaccuish » Wed, Mar 28, 2018, 5:20 PM UTC

Revelation of the century...

Re: Basic Authentication over HTTP – The Evil

#13

Post by zie » Wed, Mar 28, 2018, 6:15 PM UTC

billpg wrote: post #10

Suppose I develop a website that uses basic authentication. Because this is 2018, I store my user's passwords using bcrypt/scrypt/PBKDF2/et al. Every single request supplies the claimed password in the clear (wrapped in HTTPS) so I would need to run the long hashing process for every single request. I could maybe cache those clear-passwords that I know are good in memory, but that's getting dangerously close to stori…

yes, get more CPU's if your auth server is hitting it's limits.

Scale it by moving auth to it's own URL, so you can then load-balance it differently if needed (and can add more security like disallowing Javascript at all - via headers, etc)

But first, verify you are actually hitting CPU max because of bcrypt/scrypt/etc and not just because of crappy code or something.