Re: [http-auth] Last Call: <draft-ietf-httpauth-basicauth-update-05.txt> (The 'Basic' HTTP Authentication Scheme) to Proposed Standard

[Barry Leiba <[e-mail]>]

On the "obfuscation" point:

>>> I do not think the use of Base64 is intended as obfuscation and it seems
>>> misleading to me to describe it as such. (The Introduction has the same
>>> problem).
>>
>>I think it was.
>
> I would take it to mean, in this context, "make difficult to decode",
> while it's more likely used to "deal with special characters". In any
> case, if the idea is to note that Base64 is easily reversible, say that
> instead of "obfuscated".

Obfuscation doesn't have to be hard to decode.  The point is that one
reason base64 was used was to make it so usernames and passwords don't
appear clearly in datastreams and log files.  If you know where to
find them, they're trivial to decode, of course.  But you can't just
scan the data and say, "Ah, look, there's a username and password."

Barry