Subject: [http-auth] HTTP Digest - Username Protection

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 10 Dec 2013 14:53:39 -0500

Hi,

The HTTP Digest Authentication mechanism protects the transport of the
user's password, but does not provide any protection to the user's username
as it is transported in plain text that can be easily intercepted in
connections without TLS or with a "Man in the Middle" attacks.

Sophie and I have been discussing a way to address this limitation and we
would like to add this goal to the charter, but we would like to get the
opinion of the ADs and WG and on this.

We would appreciate any feedback on this request.

Regards,
 Rifaat

---

From: Michael Sweet <[email-masked]>
Date: Tue, 10 Dec 2013 18:29:57 -0500

Rifaat,

I think this is something worth discussing/investigating, but it may be better (read: fewer interoperability/compatibility issues) to simply define a new method that protects both the username and password using accepted cryptographic methods.

On Dec 10, 2013, at 2:53 PM, Rifaat Shekh-Yusef <[email-masked]> wrote:

> Hi,
> 
> The HTTP Digest Authentication mechanism protects the transport of the user's password, but does not provide any protection to the user's username as it is transported in plain text that can be easily intercepted in connections without TLS or with a "Man in the Middle" attacks.
> 
> Sophie and I have been discussing a way to address this limitation and we would like to add this goal to the charter, but we would like to get the opinion of the ADs and WG and on this.
> 
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

_______________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 11 Dec 2013 08:38:45 -0500

Thanks Michael,

I feel that creating a new method for this is an overkill. Let's see if
others have an opinion of this.

Regards,
 Rifaat

On Tue, Dec 10, 2013 at 6:29 PM, Michael Sweet <[email-masked]> wrote:

> Rifaat,
>
> I think this is something worth discussing/investigating, but it may be
> better (read: fewer interoperability/compatibility issues) to simply define
> a new method that protects both the username and password using accepted
> cryptographic methods.
>
>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Fri, 13 Dec 2013 13:25:59 -0500

Sean, Stephen,

Any thoughts about this?

Regards,
 Rifaat