I looked through attacks in my access logs

Re:I looked through attacks in my access logs by yjftsjthsd-h on Sunday January 28, 2024 @11:07AM (#39166973)

Or, depending on practical constraints, even http simple auth via nginx/apache reverse proxy.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by ggpsv on Sunday January 28, 2024 @11:17AM (#39167062)

Yes, though I'd say _and_ not _or_. Just because you're using a VPN it doesn't mean you should drop all forms of authentication.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by Aachen on Sunday January 28, 2024 @12:14PM (#39167696)

I am not aware of a vulnerability in popular web server software that affected a basic auth login screen for over a decade. Assuming you use a proper password and don't typo the domain and end up on someone who wants to specifically phish you through typo squatting, it's about as solid as SSH or Wireguard

They serve different use-cases but I wouldn't say that VPN is strictly better than HTTP auth or vice versa. Recommending to double up for a self-hosted little something, not a big target like 4chan or Gmail, is overkill

[ Parent | on HN ]

Re:I looked through attacks in my access logs by ggpsv on Sunday January 28, 2024 @12:50PM (#39168015)

What I'm saying is that security is about layers. I agree with you, a VPN and HTTP auth is not apples to apples where one is better than the other.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by yjftsjthsd-h on Sunday January 28, 2024 @11:22AM (#39167115)

Well, I did mean or; sometimes just sticking httpd in front of the application with a user:pass over https is fine, and also much easier if the client can't run a VPN client or doesn't want to.

[ Parent | on HN ]