Re:Using HTTP Basic Auth in 2022
by staticassertion on Saturday January 01, 2022 @05:36PM
(#29763583)
You are correct. I (and I think most people?) consider that to be the most common attacker scenario.
[ Parent
| on HN ]
Gotcha - and I can definitely see the utility with a large userbase.
From a corporate perspective, with a segmented + well-firewalled architecture, and a lot of surface area for injection vulns, I totally agree with you. The article was priming me to think of a flat, single-box solodev environment, where if someone breaks in, they own everything - which is why I think the original post above us mentioning PAKE is getting a lot of questioning.