(July 1995)
|
|
Firewalls (July 1995) |
> then a popup is displayed, asking for username/passwd. What is entered by the > user is uuencoded and sent back to the proxy, using Proxy-authorization header. Eep! Totally subject to snooping/replaying attack! The basic mechanism of sending an encrypted token as the challenge to be decrypted by the password (like Kerberos does) is so well known, why didn't they use it? References:
|