ietf
[Top] [All Lists]

Re: [http-auth] Last Call: <draft-ietf-httpauth-basicauth-update-05.txt> (The 'Basic' HTTP Authentication Scheme) to Proposed Standard

2015-02-06 10:42:29
On the "obfuscation" point:

I do not think the use of Base64 is intended as obfuscation and it seems
misleading to me to describe it as such. (The Introduction has the same
problem).

I think it was.

I would take it to mean, in this context, "make difficult to decode",
while it's more likely used to "deal with special characters". In any
case, if the idea is to note that Base64 is easily reversible, say that
instead of "obfuscated".

Obfuscation doesn't have to be hard to decode.  The point is that one
reason base64 was used was to make it so usernames and passwords don't
appear clearly in datastreams and log files.  If you know where to
find them, they're trivial to decode, of course.  But you can't just
scan the data and say, "Ah, look, there's a username and password."

Barry

<Prev in Thread] Current Thread [Next in Thread>