Digest access authentication: Difference between revisions

Revision as of 20:57, 20 July 2020

Revision as of 15:02, 27 August 2020

Line 94:

* Server nonce is allowed to contain timestamps. Therefore, the server may inspect nonce attributes submitted by clients, to prevent [[replay attack]]s

* Server is also allowed to maintain a list of recently issued or used server nonce values to prevent reuse

yigtihhjhjkyjhihjikl,, ;;;;h;j,h;n.;h. lko

* It prevents [[Phishing]] because the plain password is never sent to any server, be it the correct server or not. (Public key systems rely on the user being able to verify that the URL is correct.)

=== Disadvantages ===