Subject: Microsoft to Strike IE URL Passwords

From: Dave Kristol <[email-masked]>
Date: Thu, 29 Jan 2004 14:37:53 -0500 (EST)

<http://www.internetnews.com/dev-news/article.php/3305741>

If I understand this article correctly, it sounds like MS IE will remove support 
for Basic Authentication.  While we all agree that cleartext passwords are evil, 
this sounds to me like it will create a major compatibility problem at sites 
that use Basic.  And note that it covers Basic over SSL, too, where the 
passwords would *not* be cleartext.

Dave Kristol

---

From: Julian Reschke <[email-masked]>
Date: Fri, 30 Jan 2004 11:30:54 +0100

Dave Kristol wrote:
> If I understand this article correctly, it sounds like MS IE will remove 
> support for Basic Authentication.  While we all agree that cleartext 
> passwords are evil, this sounds to me like it will create a major 
> compatibility problem at sites that use Basic.  And note that it covers 
> Basic over SSL, too, where the passwords would *not* be cleartext.

Looking at 
<http://support.microsoft.com/default.aspx?scid=kb;[LN];834489>, it 
seems that they do not discontinue Basic Auth, they just disallow 
embedding credentials in URLs. That's something different.

Julian

-- 
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760