Subject: Password protected access

From: "Potts, Ross A." <[email-masked]>
Date: Mon, 20 May 2002 09:46:17 -0700

Is there a way to encrypt the login window That I get when I want to reach
restricted areas?  I have the password file setup and can log in, but I
understand that the password is sent in plaintext.  I didn't see much in the
way of documentation about this.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Peter Viertel" <[email-masked]>
Date: Mon, 20 May 2002 18:03:48 +0100

Sure,

If you're going to use the default http auth mechanism, then use SSL.

if the URL is https:// something then it's all encrypted. (ok, unless
you do something really odd with the server config).

Note that the 'password window' is something your browser displays -
once it's got the password it will usually post that password in a
header in every  subsequent request to the same domain name.

If you're not planning on using SSL (one would then ask why you posted
the question to modssl-users....) then consider using mod_auth_digest.

---

From: Andreas Gietl <[email-masked]>
Date: Mon, 20 May 2002 19:02:00 +0200

On Monday 20 May 2002 18:46, Potts, Ross A. wrote:

Hi Ross,

it isn't true it is sent plaintext. It is sent base64 encrypted, which is in 
case of security just as insecure as plaintext.

But if you connect to the host containing the password-realm via ssl/https 
your password is encrypted just the same way any other data would be 
encrypted with ssl. 

andreas

> understand that the password is sent in plaintext.  I didn't see much in
> the way of documentation about this.

-- 
e-admin internet gmbh
Andreas Gietl
Ludwig-Thoma-Strasse 35
93051 Regensburg
tel +49 941 3810884
fax +49 941 3810891
mobil +49 171 6070008