Slashdot Mirror
IE, Apache Clash on Web Standard
sbsea1 writes "Here is another instance where Microsoft is going one way and everybody else going to other.
eWEEK Labs found that Microsoft is using a different implentation of digest authentication which differs from the W3C's digest authentication standards. Internet Explorer Version 5.0 and higher--as well as Microsoft's IIS Web server--has a significant security incompatibility with other major Web browsers and with the Apache Software Foundation's Apache HTTP Web server."
the article says that even MS spokespeople are admitting that it's a bug. I dont see it as anything to get all up in arms and angry about.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
We [microsoft] were told by the Apache group that it would support multiple digest protocols. The MS Digestion protocol just hasn't been implemented by Apache yet.
In other words, like the libXML problem we all remember from last year, this is Apache's fault.
my younger brother likes to troll. he sometimes uses my computer and hits the ac box. me forgot this time. my golly did he ever have a white face when i caught him.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Someone reported it to Microsoft and they admitted it's a bug. This is a clash?
- Steve
...MS spokespeople are admitting that it's a bug...
This incompatibility has been in place for about 2 years in IE, and is also built-in to IIS. That is not an oversite. That is yet another example of a company trying to pick and choose which standards they can disregard with impunity.
Make no mistake, Microsoft aren't going to willingly "comply" with any technology or standard that facilitates fair competition.
Does anyone have any real information about the actual differences between how Microsoft and Apache are computing the message digest? The article does not say much. I know the Microsoft and Netscape used to have some interop problems because one implemenation (Netscape's, I think) would include a string's NUL terminator when computing a message digest. This would obviusly lead to a different result.
cpeterso
It's not a bug - it's a feature ;)
Microsoft is not doing anything which other companies don't do. They are just too big to be ignored, that's the real problem.
But that's our own fault. Why do we buy and use MS products? Why do we program for Microsoft (directly or indirectly)? Could be we all have the same motive$ as M$ has? And are just envious, because if M$ coughs, everyone else has a cold?
No need to change a single line of code in Apache. Apache is the de-facto standard, not IIS.
These days, for casual passwords like /. logins, HTTP basic authentication is still usually good enough. For passwords that need real security, use mod_ssl instead, which is easily added to Apache 1.3 and comes with Apache 2.0 by default, and do basic auth over SSL so the whole HTTP stream is encrypted including the password. HTTP digest authentication's security is sort of halfway between HTTP basic auth and HTTPS basic auth. As a halfway measure, it's not really that useful any more.
You can post to Slashdot using MS FrontPage? Sweeet!
I don't understand "The problem with BASIC is you have to trust the end point", unless you mean you have to give them a password that you might also be using on other sites. Of course by even giving them the digest of the password, you let them mount an offline dictionary search. That means that the site also needs to keep the digest secret from attackers who might also want to do searches, so again you have to trust the site's security.
I agree with Netscape that unencrypted BASIC is good enough for a lot of purposes (how bad is it if someone intercepts your Slashdot password and changes your user preferences?). Applications that need more security (online banking) need enough design attention that buying a certificate ($125/year) isn't that big a deal. Low traffic sites can always use self-signed certificates which cost nothing (but pop a browser dialog when the user first connects). Really high security applications should use SSL client certificates instead of passwords. That avoids the need for any shared secrets. If you really want to use passwords over an unencrypted channel, it's best to use a protocol like SRP, though like SSL, SRP would have been a problem before the DH patent expired.
Yes, if you look at the spectrum of all possible web applications, there's probably some examples where Digest is slightly preferable to the next best alternative, but with SSL easily available Digest just doesn't seem like a big deal any more.
Actually, it was a reference to the infamous AARD code which was probably intended to intimidate customers into avoiding the rival DR-DOS. This was one of the major pieces of evidence in Caldera vs. Microsoft. Do some research on that-- you may be surprised at what you see.
No, I do not runn Windows 3.1 nor do I run DR DOS.
LedgerSMB: Open source Accounting/ERP
I don't use Windows Authentication in my applications because it wont work in anything but IE. I guess the same can be said for digest.
huperMuito :*
It's amazing what can be done when one has more money now than even Michael Jordon could make in 400 years. This isn't the first time MS is fucking w/apache. Anyone here tried to set up MS Media streaming and use .htaccess rewrite for security? Good luck! Hell, if your u/p is posted as part of your URL(http://user:pass@www.here.com) IE tries to download every image as untitled.bmp. WTF? How many anti-trust suits do we need?
Evidently Bill doesn't have enough money to not be worried about a free OS that is far superior. It's like AOL trying to convince the world that setting up a PPP client is so hard that "AOL is so easy no wonder it's number one!"
The new (old?) american motto "The truth is what I say it is!"
There is no logic, only space. theARTofConfusion