News for hackers. Stuff that matters.

A comment on IOT Developer Security Checklist. Parent comment

Re:IOT Developer Security Checklist by aeronautic on Thursday May 25, 2017 @05:48PM (#14420386)
Do you mean basic & digest http auth built into the browsers? If so, yes, they are bad. The issue is you cannot reliably implement log off on all browsers.
[ Parent | on HN ]
Re:IOT Developer Security Checklist by jessaustin on Thursday May 25, 2017 @08:07PM (#14421073)
Is this still true, for any browser that is still used? It seems a couple of decades would be long enough to get this right...
[ Parent | on HN ]
Re:IOT Developer Security Checklist by aeronautic on Thursday May 25, 2017 @08:28PM (#14421191)
Still true when I tested last year. The core protocol does not have a defined way to get the browser to forget the login.

You have to resort to different fudges on different browser.

Net/Net: the http auth ui sucks, has bad usability, weak crypto, and is not robust with logout.

HTML/form based auth can be made robust and is a preferable alternative in every case.

[ Parent | on HN ]
Re:IOT Developer Security Checklist by pyre on Thursday May 25, 2017 @10:40PM (#14421690)
I'm taking about using the 'Authentication: ' headers, not relying on the browser's handling of auth (other than making the requests).
[ Parent | on HN ]