Useless Digest Auth

On Sam Ruby’s blog, Simon Fell suggested using digest-auth to proect user weblogs when they post at conferences etc.

This suggestion is misguided. The only thing that digest auth secures is passwords themselves. It does NOT prevent a man-in-the-middle from modifying the content of a POST to anything it/he damn well pleases. It does NOT prevent a MITM from modifying the content of an HTTP response to generate lots of javascript or 30x redirects requests to give lots of request tokens with which to play.

Someone on a conference net providing their own DHCP/DNS could have lots of fun with people relying on such primitive stuff. But, hey, at least they won’t get passwords!

If you actually care to prevent third parties from POSTing as you, use SSL or some content-level standard like PGP, S/MIME, or XML-DS that is less vulnerable to trivial MITM attacks.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: