There are various HTTP authentication mechanisms to authenticate the user towards web application. Which of the following authentication schemes where login / password credentials are sent to the web server in clear text ?
-
Client Certificates
-
Basic
-
Digest
-
NTLM
To solve this question, the user needs to have knowledge of different HTTP authentication mechanisms and their characteristics.
Now, let's go through each option and explain why it is right or wrong:
A. Client Certificates: This option is incorrect because client certificates are used to authenticate the client to the server and are typically encrypted, not sent in clear text.
B. Basic: This option is correct. Basic authentication is one of the simplest authentication schemes and sends login and password credentials in clear text. This means that if someone intercepts the traffic, they can read the credentials and potentially use them to gain unauthorized access to the system.
C. Digest: This option is incorrect because Digest authentication uses a challenge-response mechanism to authenticate the user and does not send the credentials in clear text.
D. NTLM: This option is incorrect because NTLM authentication uses a challenge-response mechanism and does not send the credentials in clear text.
Therefore, the correct answer is:
The Answer is: B
HTTP Basic Authentication sends the username and password as a Base64-encoded string in the Authorization header — Base64 is only an encoding, not encryption, so credentials are effectively sent in clear text unless the whole connection is wrapped in TLS. Client Certificates authenticate via public-key cryptography, not transmitted passwords. Digest authentication hashes the credentials with a nonce before sending, avoiding clear-text transmission. NTLM uses a challenge-response protocol that also avoids sending the raw password. So Basic is the correct answer.