Subject: RE: Microsoft to Strike IE URL Passwords

From: "Paul Leach" <[email-masked]>
Date: Fri, 30 Jan 2004 14:32:09 -0500 (EST)

You read it incorrectly. We're changing IE so that passwords embedded in
HTTP URLs won't be allowed. This puts us in compliance with 2616 and 1738
(and sucessor). 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Dave Kristol
> Sent: Thursday, January 29, 2004 11:38 AM
> To: HTTP Working Group
> Subject: Microsoft to Strike IE URL Passwords
> 
> 
> 
> 
> 
> <http://www.internetnews.com/dev-news/article.php/3305741>
> 
> If I understand this article correctly, it sounds like MS IE 
> will remove support for Basic Authentication.  While we all 
> agree that cleartext passwords are evil, this sounds to me 
> like it will create a major compatibility problem at sites 
> that use Basic.  And note that it covers Basic over SSL, too, 
> where the passwords would *not* be cleartext.
> 
> Dave Kristol
> 
>