Re: [apps-discuss] [kitten] [saag] HTTP authentication: the next generation

[Yoav Nir <[e-mail]>]

Because I'd rather not implement too many mechanisms in my browser or in my web server.

And if EAP integrates better with RADIUS, while SASL integrates better with LDAP, it's still bad design to expose the server's backend to the client by the authentication protocol.

Let's try and list the requirements for HTTP authentication:
- It has to be integrated in the protocol, not the application
- It has to be secure against phishing - if the attacker gets you to authenticate, they can't later use that authentication to connect to the real server
- If the authentication succeeded, then (a) you typed your password correctly, and (b) this is really the server

EAP has some methods that do this. SASL can probably be made to do this, but with an extra layer.

On Dec 12, 2010, at 11:36 PM, Eliot Lear wrote:

> Why settle for one?
> 
> On 12/12/10 7:40 PM, Alexey Melnikov wrote:
>> Yoav Nir wrote:
>> 
>>> EAP has one advantage. It is easy to integrate with existing
>>> RADIUS/DIAMETER infrastructure.
>>> 
>> True.
>> And SASL has an advantage that it is easier to integrate with LDAP
>> infrastructure.
>> 
>> I think this just demonstrates that before an HTTP authentication
>> mechanism can be evaluated, people need to agree on a common
>> evaluation criteria for HTTP authentication.
>> 
>> _______________________________________________
>> apps-discuss mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/apps-discuss
>> 
> 
> Scanned by Check Point Total Security Gateway.