Still using HTTP Basic Auth?

Thu, 18 Apr 2013 15:22:17 +0000

Great article by Steve Graham about why you should stop using HTTP Basic Auth immediately!

As well as being tremendously simple, HTTP Basic by itself is also tremendously insecure, i.e. it is implemented by simply Base64 encoding the username and password concatenated with a colon “:” character. It then follows that HTTP Basic should only be used, if at all, over securely encrypted connections.

Original article: WHY THE HELL DOES YOUR API STILL USE HTTP BASIC AUTH?

How to share a secret

Sat, 03 Jan 2009 17:15:38 +0000

“How to Share a Secret” is the title of paper written in 1979 by Adi Shamir (best known for his work on the RSA algorithm). The paper describes a method for dividing information in smaller pieces so that the knowledge of all but one of the pieces gives absolutely no information about the original information. Quoting the author:

This technique enables the construction of robust key management schemes for cryptographic systems that can function securely and reliably even when misfortunes destroy half the pieces and security breaches expose all but one of the remaining pieces.

Password on Bruno Pedro

Still using HTTP Basic Auth?

How to share a secret