News for hackers. Stuff that matters.
Re:Using HTTP Basic Auth in 2022 by gjsman-1000 on Saturday January 01, 2022 @03:59PM (#29762705)
I guess this makes sense - but who is capable of decrypting it weeks later unless the original private key was stolen, in which case it could be decrypted almost in real-time? Maybe if you were concerned a nation-state or something was trying to get your private key, but you've got bigger fish to fry at that point.
Re:Using HTTP Basic Auth in 2022 by w3ll_w3ll_w3ll on Saturday January 01, 2022 @04:31PM (#29763042)
Also, using TLS with Perfect Forward Secrecy (all modern ciphers), it's not possible to just capture the traffic and dectypt it later. You have to know the private key and do MITM.
Re:Using HTTP Basic Auth in 2022 by rixed on Saturday January 01, 2022 @11:10PM (#29765740)
> You have to know the private key and do MITM.

Which can safely be assumed to happen whenever the equipment is provided by another party such as an employer. All in the name of security, just not that of the user.