10

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered acceptable.

Is proxy authentication different than regular basic auth? Based on this article, it seems like it is not different. Does basic proxy authentication expose credentials to anyone listening on the connection?

William Rosenbloom
  • 1,516
  • 2
  • 6
  • 12

1 Answers1

8

HTTP Basic over an unsecured connection exposes the username and password, as you expected. Even over an encrypted connection, basic auth isn't ideal because it exposes the credentials on every new request, which means they're constantly held in memory, you can't revoke a session, and using a secure password hashing function (which should take a good fraction of a second) would be prohibitively expensive.

However, for services where there's no actual resources being protected (no sensitive user account data or control of restricted services) and the goal is just to keep the riff-raff off the proxy, it might be sufficient. Knowing the proxy credentials probably won't give the attacker any ability that they didn't already need in order to capture those credentials, except the ability to use the proxy themselves. Obviously that's bad if the proxy is doing something like access to a corporate internal network - those should be protected by a VPN or similar - but if it's just changing the country your connection appears to come from? Probably not a big deal.

CBHacking
  • 40,303
  • 3
  • 74
  • 98
  • The resource that's being protected could be your identity. If someone uses the proxy to launch an attack of some kind, they could impersonate you so you'll get the blame. – Barmar Dec 28 '20 at 15:17
  • @Barmar Well, third parties (target servers) can't in general get reliable information about how you authenticated to the proxy, and for the proxy operator it's going to be trivial to see that the credentials were compromised, so whatever blame comes will be easy to deflect. – TooTea Dec 28 '20 at 15:35
  • 1
    While I agree that the blame can be refuted, is it really "trivial"? I presume you'd do something like check if the client IP belongs to them. It seems like using a more effective authentication method would prevent most of this, so why not do it? – Barmar Dec 28 '20 at 15:43