Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • thg thg
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 838
    • Issues 838
    • List
    • Boards
    • Service Desk
    • Milestones
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • mercurial
  • TortoiseHg
  • thgthg
  • Issues
  • #4144

Closed
Open
Created May 05, 2015 by Bitbucket Importer@bitbucket_importerOwner

Basic autnentication is only weakly secure

Created originally on Bitbucket by DankMaymays (Bubba)

Basic authentication over SSL doesn't provide good security. The large attack window caused by sending the password with every request is just one of numerous issues ([1], [2], and many others).

With TortoiseHg, it seems like the only other option is SSH. This doesn't fit many situations (I'm talking about self-hosted, not Bitbucket), and has disadvantages, such as lack of browseability. Providing this side-by-side with basic auth and encouraging the devs to use SSH is a sort-of-ok-but-not-great compromise.

There really ought to be support for better web-based autnentication, such as TLS client-side certificates.

References: [1] http://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https [2] http://adrianotto.com/2013/02/why-http-basic-auth-is-bad/

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking