Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Mon, May 07, 2001 at 01:08:11PM -0400, Paula Paul wrote:
> > Or, if you want to use what the rest of the Internet has used 
> > since IIS
> > was just a memory leak in Microsoft's eye, you could enable Basic auth
> > in IIS. Here's a rundown of all the different authentication methods
> > supported by IIS:
> 
> If you do choose to go with Basic Authentication (one of the
> authentication methods you can enable on the tab used to disable
> annonymous access, as described in my earlier post), you may want to use
> it in conjunction with SSL.  Basic Authentication means that the userid
> and password will be sent as clear text (thus it's better to require
> secure HTTP). 

Technically, the user/pass combination is sent as a Base64-encoded string,
not clear text, though Base64 isn't encryption (more like a fancy ROT-13)
so your advice with respect to SSL is correct, if what you're protecting
is really worth the hassle.

> Since Basic Authentication ties the authentication to a
> domain account and password, you may want the password encrypted.
> If you choose windows integrated authentication, the password will also
> be tied to a domain account, but it will not be sent in clear text.

It will also not be usable in any browser that doesn't support NTLM
authentication, namely, everything but Internet Explorer. I'm not sure
if IE5/Mac even supports NTLM. I seem to recall problems with IE4.5,
at any rate.

In summary, Basic auth is fine for most purposes, and can be
supplemented by SSL. If you don't want to encrypt the entire session,
and your audience uses browsers that understand Microsoft-proprietary
authentication, and you want to bother setting up user accounts for
all of your Web visitors, and you don't want to bother setting up a
proprietary database to manage user accounts, you can use NTLM.

-- 
"Euphoria is not a business strategy" -- Louis Rossetto