Re:Using HTTP Basic Auth in 2022
by gjsman-1000 on Saturday January 01, 2022 @03:59PM
(#29762705)
I guess this makes sense - but who is capable of decrypting it weeks later unless the original private key was stolen, in which case it could be decrypted almost in real-time? Maybe if you were concerned a nation-state or something was trying to get your private key, but you've got bigger fish to fry at that point.
[ Parent
| on HN ]
Re:Using HTTP Basic Auth in 2022
by w3ll_w3ll_w3ll on Saturday January 01, 2022 @04:31PM
(#29763042)
Also, using TLS with Perfect Forward Secrecy (all modern ciphers), it's not possible to just capture the traffic and dectypt it later. You have to know the private key and do MITM.
> You have to know the private key and do MITM.
Which can safely be assumed to happen whenever the equipment is provided by another party such as an employer. All in the name of security, just not that of the user.