I guess if you use lynx to surf to http basic auth URLs you should switch to another browser until a security update is available. But I'm inclined to say while this is an interesting bug I don't think that's an incredibly common scenario.

Update: It seems there's a preliminary patch that will not fix http auth URLs, but will prevent the info leak: https://www.openwall.com/lists/oss-security/2021/08/07/7

Plain auth websites are pretty uncommon these days. That said, if using other authentication methods are annoying or inconvenient in Lynx (I don't know, I've never used it) then there may be some correlation between Lynx users and plain auth websites meaning this could impact a large fraction of Lynx the userbase.

Http basic authentication urls are never secure (that requires https) and are not supported in links by browsers these days.

This bug only affects HTTPS basic auth, given that the issue is with SNI (and, of course, that basic auth over HTTP doesn’t have any encryption to leak around).

This is my understanding from reading the OP. Lynx is a CLI browser and apparently it sends plain-auth credentials in the clear in the SNI/hostname part of the https/tls handshake. I suppose someone forgot that the authority part of a uri has a slot for both userinfo as well as host, and parsed it wrong. [0]

As far as mitigations go, I guess any of these would work: don't use Lynx; don't use SNI (???); don't use plain auth.

[0]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Sy...

Don't use urls like https://user:[email protected]