Subject: [http-auth] Additional security considerations for draft-ietf-httpauth-basicauth-update-01

From: Michael Sweet <[email-masked]>
Date: Wed, 09 Jul 2014 10:39:46 -0400

All,

I think we should say something about brute-force attacks on HTTP Basic; since the client has to do basically no work to provide a Basic Authorization header, it is very easy for an attacker to try thousands of common usernames and passwords in a short period of time.  A server can mitigate this somewhat by tracking the number of failed authentication attempts over a specific time span from a given IP address and either return 403's for all subsequent attempts or delay responses; the latter approach could lead to more DoS opportunities, of course...

I'm happy to draft up something official - comments welcome!

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair