You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sf...@apache.org on 2014/01/05 17:25:27 UTC
svn commit: r1555566 - in /httpd/httpd/branches/2.2.x: ./
docs/manual/howto/auth.xml docs/manual/mod/mod_auth_digest.xml
Author: sf
Date: Sun Jan 5 16:25:27 2014
New Revision: 1555566
URL: http://svn.apache.org/r1555566
Log:
Merge r1554276, r1554281, r1555555 from trunk:
digest auth is only marginally more secure than basic auth.
Adjust the docs to today's reality.
mention insecure password storage as pointed out by Graham
axe one more case of digest auth being described as secure
Modified:
httpd/httpd/branches/2.2.x/ (props changed)
httpd/httpd/branches/2.2.x/docs/manual/howto/auth.xml
httpd/httpd/branches/2.2.x/docs/manual/mod/mod_auth_digest.xml
Propchange: httpd/httpd/branches/2.2.x/
------------------------------------------------------------------------------
Merged /httpd/httpd/trunk:r1554276,1554281,1555555
Merged /httpd/httpd/branches/2.4.x:r1555538,1555559
Modified: httpd/httpd/branches/2.2.x/docs/manual/howto/auth.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/howto/auth.xml?rev=1555566&r1=1555565&r2=1555566&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/howto/auth.xml (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/howto/auth.xml Sun Jan 5 16:25:27 2014
@@ -209,8 +209,9 @@ module from each group.</p>
highly sensitive data, unless accompanied by <module>mod_ssl</module>.
Apache supports one other authentication method:
<code>AuthType Digest</code>. This method is implemented by <module
- >mod_auth_digest</module> and is much more secure. Most recent
- browsers support Digest authentication.</p>
+ >mod_auth_digest</module> and was intended to be more secure. This is no
+ longer the case and the connection should be encrypted with <module
+ >mod_ssl</module> instead.</p>
<p>The <directive module="core">AuthName</directive> directive sets
the <dfn>Realm</dfn> to be used in the authentication. The realm serves
Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/mod_auth_digest.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/mod_auth_digest.xml?rev=1555566&r1=1555565&r2=1555566&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/mod/mod_auth_digest.xml (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/mod/mod_auth_digest.xml Sun Jan 5 16:25:27 2014
@@ -32,7 +32,14 @@
<summary>
<p>This module implements HTTP Digest Authentication
(<a href="http://www.faqs.org/rfcs/rfc2617.html">RFC2617</a>), and
- provides a more secure alternative to <module>mod_auth_basic</module>.</p>
+ provides an alternative to <module>mod_auth_basic</module> where the
+ password is not transmitted as cleartext. However, this does
+ <strong>not</strong> lead to a significant security advantage over
+ basic authentication. On the other hand, the password storage on the
+ server is much less secure with digest authentication than with
+ basic authentication. Therefore, using basic auth and encrypting the
+ whole connection using <module>mod_ssl</module> is a much better
+ alternative.</p>
</summary>
<seealso><directive module="core">AuthName</directive></seealso>
@@ -70,9 +77,16 @@
</example>
<note><title>Note</title>
- <p>Digest authentication is more secure than Basic authentication,
- but only works with supporting browsers. As of this writing (December
- 2012) all major browsers support digest authentication.</p>
+ <p>Digest authentication was intended to be more secure than basic
+ authentication, but no longer fulfills that design goal. A
+ man-in-the-middle attacker can trivially force the browser to downgrade
+ to basic authentication. And even a passive eavesdropper can brute-force
+ the password using today's graphics hardware, because the hashing
+ algorithm used by digest authentication is too fast. Another problem is
+ that the storage of the passwords on the server is insecure. The contents
+ of a stolen htdigest file can be used directly for digest authentication.
+ Therefore using <module>mod_ssl</module> to encrypt the whole connection is
+ strongly recommended.</p>
</note>
</section>