- Running Lighttpd
- Using ssl (mod_ssl)
- Want to password protect a directory (mod_auth). Need very good security on this dir as i will mount my hd to it
- Since it's already over ssl, do I have to mess with digest authentication or is the password, etc. already encrypted because of the ssl?
What I am asking is lets say you have a password protected HTTP page. Without SSL the password is sent plaintext unless you use digest auth. With SSL, isn't the password sent crypted? So then, I can use plan auth and not digest auth.
But digest auth isn't hard to setup. I was just wondering.
Name:
Anonymous2007-08-18 1:35 ID:psLz/VsA
Digest auth is also very weak. Do not use it on its own.
SSL works between HTTP and TCP, so you can use whatever HTTP authentication you want securely.
Name:
Anonymous2007-08-18 1:38 ID:zyZ/WtkP
Both would be best then. Gotcha. Thank you :)
Name:
Anonymous2007-08-18 4:49 ID:psLz/VsA
>>5
Not really. Using SSL with plain auth is sufficient. If they break through SSL, they won't even notice digest.
If you feel like using digest as well, go for it, but it's not buying you any additional security. SSL is what's critical.