Living without the modern browser

Re:Living without the modern browser by groby_b on Wednesday July 10, 2019 @12:51PM (#20403785)

It's still a security risk. MITM happens regularly. Which means you better constrain it to either low-risk auth, or to networks you completely control.

For further risks, see e.g. https://security.stackexchange.com/questions/988/is-basic-au...

Yes, it's simple. And you're trading off security for simplicity. Make that choice, maybe, for your Intranet or your small blog. Commercial sites that have stored PII really, REALLY shouldn't.

[ Parent | on HN ]

Re:Living without the modern browser by ori_b on Wednesday July 10, 2019 @02:57PM (#20405197)

> It's still a security risk. MITM happens regularly.

Then it's more or less as broken as alternative authentication methods

[ Parent | on HN ]

Re:Living without the modern browser by groby_b on Wednesday July 10, 2019 @04:34PM (#20406244)

Nope. Because other methods never transmit a password in cleartext. (And they especially don't transmit it with every single request)

[ Parent | on HN ]

Re:Living without the modern browser by c22 on Wednesday July 10, 2019 @09:45PM (#20408439)

How do they manage this feat over unencrypted stateless http? Surely they must transmit something with every request?

[ Parent | on HN ]

Re:Living without the modern browser by messe on Wednesday July 10, 2019 @01:10PM (#20403978)

Thanks for the link, it's a good summary of the trade offs.

[ Parent | on HN ]