iis security: Is it safe using Basic Authentication when using HTTPS -- iis security

Is it safe using Basic Authentication when using HTTPS

Paw Pedersen
7/11/2007 5:07:21 PM

iis security:

As far as I can find out, the SSL handshake is being done before the basic
authentication credentials is passed through the network, so it will be
encrypted, and not possible to sniff. Can anybody please confirm that?

Best regards
Paw Pedersen

Re: Is it safe using Basic Authentication when using HTTPS

Ken Schaefer
7/12/2007 12:00:00 AM

Your understanding is correct - traffic is encrypted prior to any
transmission of credentials in the HTTP entity.

Depending on the key strength of your asymmetric and then session keys, it
may be possible to brute force the encrypted packets after they have been
sniffed.

Cheers
Ken

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the iis security group.