Re:Using HTTP Basic Auth in 2022
by wswope on Saturday January 01, 2022 @05:30PM
(#29763541)
If I’m understanding your argument correctly (I may not be) - implementing PAKE would only be helpful in a scenario where an attacker gets access to hashed passwords, but isn’t able to modify front-end code to directly intercept unhashed passwords, right?
[ Parent
| on HN ]
Re:Using HTTP Basic Auth in 2022
by staticassertion on Saturday January 01, 2022 @05:36PM
(#29763583)
You are correct. I (and I think most people?) consider that to be the most common attacker scenario.
Gotcha - and I can definitely see the utility with a large userbase.
From a corporate perspective, with a segmented + well-firewalled architecture, and a lot of surface area for injection vulns, I totally agree with you. The article was priming me to think of a flat, single-box solodev environment, where if someone breaks in, they own everything - which is why I think the original post above us mentioning PAKE is getting a lot of questioning.