Can an authentication via HTTP over IIS be encrypted (without SSL)? -


I'm addicted to * nix servers and if we want a fully secure sign-in screen, we (as far as I I know) Using SSL through HTTPS Our organization on the job uses a Windows server to serve web pages. They are doing network credentials on such a page. This page is using HTTP, and

appears for the original Auth (a popup dialog) for SQL Server Report Manager.

They say that the original is disabled in IIS.

In my limited experience with the IIS in college, I (I think) that the subdomains can override the general settings, they believe that it is using integrated Windows authentication .

So ...

  1. Whether watching a web-app, there is a way to differentiate between basic athe and integrated Windows Ath. Page sign, and ...

  2. Is it possible to encrypt the communication between computers and servers during authentication so that the text is being encrypted (JS resolution without)? Both native and Windows integrated authentication send unencrypted credentials on both wires. If the popup login box has a browser name and looks like a standard window, then it is either basic or integrated if the user name / password is used to use the same as the user's domain account, this is Windows Integrated You can confirm either by sniffing the HTTP transmission with Fiddler

    In any case without SSL, any good, encryption of those credentials That's not the way it's a good article why custom security methods are a bad idea, and SSL is the way to go.


Comments