News for hackers. Stuff that matters.

A comment on Why even let users set their own passwords?. Parent comment

Re:Why even let users set their own passwords? by codazoda on Saturday July 22, 2023 @02:52PM (#36828735)
I wish there was better browser support for this but I still use it for pet projects. Last year I wrote about why I’m still using HTTP Basic Auth.

https://joeldare.com/why-im-using-http-basic-auth-in-2022

[ Parent | on HN ]
Re:Why even let users set their own passwords? by simfree on Saturday July 22, 2023 @03:36PM (#36829102)
Safari on iOS does not play nice with Basic Auth. No credential saving, re-promting you for credentials on each page you navigate to.

non-iOS browsers seem to handle HTTP basic auth gracefully.

[ Parent | on HN ]
Re:Why even let users set their own passwords? by qingcharles on Saturday July 22, 2023 @09:49PM (#36831830)
There was a time that I can remember practically every site that needed a login using basic auth, before people switched to textboxes.
[ Parent | on HN ]
Re:Why even let users set their own passwords? by herewulf on Sunday July 23, 2023 @11:46PM (#36842901)
Maybe you don't listen on port 80 but I can imagine a standard web server using Let's Encrypt, for example, that could suffer from a user leaking credentials by inadvertently using HTTP rather than HTTPS.

I have to look into some protections to this. I recently did a project and used Basic Auth for expediency thinking that later I would replace with a "proper" auth form. My theory was that this was better because sending cookies is based on the protocol also not just the domain.

[ Parent | on HN ]