[Xitami] Plaintext passwords on Bugtraq (again)

[Brian {Hamilton Kelly}]

In message <3.0.6.32.20020624091136.00a26550@mail.shininglightpro.com>
   "Thomas J. Hruska" writes:

> However, the problem still won't go away since anyone sniffing for packets
> can grab any HTTP Authorization header and store it away for a later replay
> attack (MD5 hashes included).  What is worse is that Xitami doesn't have
> DIGEST mode available which means that the username:password combination is
> only Base64 encoded (and makes it _VERY_ easy to obtain access to "secure"
> areas - e.g. remote /admin access).  Even with DIGEST mode, it still
> doesn't stop a replay attack since the HTTP protocol doesn't have any
> secure handshaking methods.
> 
> So, hashing the files might help some locally, but won't stop anyone from
> attacking the server remotely.  The problem is not necessarily with Xitami
> but also has to do with the inherent weakness of the HTTP protocol.

There's an easy answer to that: don't remotely administer the server via
HTTP!  Either walk into the machine room (or use SSH sessions) and use a
text editor.

HTTP-based administration only exists for the lazy and those who cannot
imagine use of a computer without having thinks to click.

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We have gone from a world of concentrated knowledge and wisdom to one of
    distributed ignorance.  And we know and understand less while being incr-
    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs