From 0f27b530ef19a5fa6c45b1502c9ab148b0ae4722 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Mon, 30 Dec 2013 17:37:19 +0000 Subject: [PATCH] xforms git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1554282 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_auth_digest.html.en | 15 ++++++++++----- docs/manual/mod/mod_auth_digest.xml.fr | 2 +- docs/manual/mod/mod_auth_digest.xml.ko | 2 +- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/manual/mod/mod_auth_digest.html.en b/docs/manual/mod/mod_auth_digest.html.en index 71fbc5f43a..9dd7764df7 100644 --- a/docs/manual/mod/mod_auth_digest.html.en +++ b/docs/manual/mod/mod_auth_digest.html.en @@ -38,8 +38,11 @@

This module implements HTTP Digest Authentication (RFC2617), and provides an alternative to mod_auth_basic where the - password is not transmitted as cleartext. However, the security - improvement over basic authentication is very small. Encrypting the + password is not transmitted as cleartext. However, this does + not lead to a significant security advantage over + basic authentication. On the other hand, the password storage on the + server is much less secure with digest authentication than with + basic authentication. Therefore, using basic auth and encrypting the whole connection using mod_ssl is a much better alternative.

@@ -99,9 +102,11 @@ man-in-the-middle attacker can trivially force the browser to downgrade to basic authentication. And even a passive eavesdropper can brute-force the password using today's graphics hardware, because the hashing - algorithm used by digest authentication is too fast. Therefore - using mod_ssl to encrypt the whole connection is - recommended.

+ algorithm used by digest authentication is too fast. Another problem is + that the storage of the passwords on the server is insecure. The contents + of a stolen htdigest file can be used directly for digest authentication. + Therefore using mod_ssl to encrypt the whole connection is + strongly recommended.

mod_auth_digest only works properly on platforms where APR supports shared memory.

diff --git a/docs/manual/mod/mod_auth_digest.xml.fr b/docs/manual/mod/mod_auth_digest.xml.fr index 07aeca2afe..394dbf9e7e 100644 --- a/docs/manual/mod/mod_auth_digest.xml.fr +++ b/docs/manual/mod/mod_auth_digest.xml.fr @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/mod/mod_auth_digest.xml.ko b/docs/manual/mod/mod_auth_digest.xml.ko index 7fb5dd3773..0d6179f86f 100644 --- a/docs/manual/mod/mod_auth_digest.xml.ko +++ b/docs/manual/mod/mod_auth_digest.xml.ko @@ -1,7 +1,7 @@ - +