News for hackers. Stuff that matters.

A comment on The hijacking flaw that lurked in Intel chips is worse than anyone thought. Parent comment

Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @04:41AM (#14284482)
It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.
[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by coldtea on Sunday May 07, 2017 @08:00AM (#14285025)
Very easy way around it: do NOT use digest auth.
[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @08:17AM (#14285082)
Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.
[ Parent | on HN ]