[
Lists Home |
Date Index |
Thread Index
]
>> Make sure they always connect to the site with SSL.
>
> No, the client can't choose that.
Sure. The client can decide not to risk the exposure. Sure, the server
might not do SSL, but at least the client can say "no." With digest,
you can't prevent the server from offering up a plaintext challenge, you
can only agree not to continue. So again, it's less protection.
/r$
--
Rich Salz, Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
|
