Firesheep, a day later

Re:Firesheep, a day later by mjw on Tuesday October 26, 2010 @09:45AM (#1834109)

I'd be interested to hear thoughts on HTTP digest auth as an alternative to full end-to-end encryption for avoiding these attacks.

Personally I'm hopeful that Firesheep will be what it takes to persuade browser vendors (and the HTML5 crowd) that real usable support for HTML login forms based on HTTP digest authentication is a necessity.

There are some pretty significant issues involved in rolling out full-on SSL which while not insurmountable do lead one to wonder if a more lightweight solution like HTTP digest auth might be sufficient for most non-security-critical cases.

On this topic http://www.cgisecurity.com/2010/01/weaning-the-web-off-of-se...

is worth a read.

[ Parent | on HN ]

Re:Firesheep, a day later by jcromartie on Tuesday October 26, 2010 @10:32AM (#1834312)

Definitely. The hardest thing to sell, when it comes to regular HTTP digest auth, is the user interface. People (clients) truly prefer pretty and insecure over ugly and secure.

[ Parent | on HN ]

Re:Firesheep, a day later by mjw on Tuesday October 26, 2010 @11:46AM (#1834633)

For sure. Hence the need for browser vendors to provide hooks - via new HTML5 form attributes, a Javascript API, or ideally both, to enable us to develop our own, usable HTML-based session login and logout forms with HTTP auth.

[ Parent | on HN ]

Re:Firesheep, a day later by tiles on Tuesday October 26, 2010 @01:57PM (#1835279)

This is incredibly necessary for HTTP authentication to be useful, and bizarrely, has been given little to no attention over the years. There's a proposal for HTTP authentication in HTML dating all the way back to 1999:

http://www.w3.org/TR/NOTE-authentform

With only some complex Javascript hacks making it a possible solution:

http://www.peej.co.uk/articles/http-auth-with-html-forms.htm...

Also, HTTP authentication is a benefit to RESTful service design. Cookies have always been the wrong solution to this problem, having all web services to move to HTTPS feels like missing the point.

[ Parent | on HN ]

Re:Firesheep, a day later by pornel on Tuesday October 26, 2010 @03:01PM (#1835542)

It's all been discussed by WHATWG/W3C and the conclusion was that cookies have too large momentum, Digest is not secure enough, and everyone should be using HTTPS.

http://www.w3.org/html/wg/tracker/issues/13?changelog

http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2008-Nov...

Digest is vulnerable to MITM attacks. It's only secure against passive sniffing, but if you can sniff, you usually can also modify response, spoof DNS/ARP/base station. If everyone switched to Digest, it would be only a matter of time when someone writes Digest-stripping Firesheep2.

[ Parent | on HN ]

Re:Firesheep, a day later by mooism2 on Tuesday October 26, 2010 @11:57AM (#1834682)

1. Even if Facebook used HTTP digest auth for people logging into facebook.com, I don't see how I could use HTTP digest auth for people logging into my website using their Facebook ID. (Also for OpenID, signing in with Twitter, etc.)

2. As a pragmatic matter, it seems more likely that Microsoft would update the various versions of Internet Explorer on Windows XP to support SNI, than that all web browsers (including Internet Explorer on Windows XP) would be updated to support HTTP digest auth with a customisable UI.

Having said that, I'm in favour of web browsers supporting both technologies.

[ Parent | on HN ]