Re: No More Passwords In The Clear in HTTP!

Daniel W. Connolly ([email protected])
Tue, 10 Jan 1995 04:41:47 +0100

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Paul Burchard: "Re: Web conferencing"
Previous message: Lejariel Laurent Local: "docs to build a server"
Maybe in reply to: Daniel W. Connolly: "No More Passwords In The Clear in HTTP!"
Next in thread: Daniel W. Woycke: "Re: No More Passwords In The Clear in HTTP!"

In message <[email protected]>, Jon E. Mittelhauser writes:
>
>This proposal utilizes RSA MD5 encryption. If you have this
>capability, why not go all the way to SSL (or SHTTP)? It would
>make much more sense.
>
>>
>> 2. Use a commercial browser that supports the security
>> options (SHTTP, SSL, kerberos...) supported by the services
>
>I don't see how this proposal fixes this problem. It requires MD5 which
>will require a license from RSA. How does this not fall into your class
>2 space? As long as I am in that space, I would much prefer a protocol
>which has been widely adopted by the financial community (e.g. SSL).

MD5 technology is very different from the patented public key encyption.
It's just a secure hash function. There are others -- SHS, MD4, etc.

Anyway... the md5 source code is all over the place. There's an md5
module in the Python distribution, so I'm pretty sure there are no
prohobitive licensing restrictions.

Dan

Next message: Paul Burchard: "Re: Web conferencing"
Previous message: Lejariel Laurent Local: "docs to build a server"
Maybe in reply to: Daniel W. Connolly: "No More Passwords In The Clear in HTTP!"
Next in thread: Daniel W. Woycke: "Re: No More Passwords In The Clear in HTTP!"