Re: Insecure WWW Access Authorization Protocol?

Tony Sanders (sanders@BSDI.COM)
Wed, 9 Mar 1994 21:11:22 --100

michael shiplett <> writes:
> 2) Mallet intercepts the request and sends to Alice:
> 401 Unauthorized
> Authenticate: KerberosV4 ""
> This is the critical step, because Mallet is able to control to
> which service Alice should authenticate herself.

Would someone please explain to me why a user would enter a password
at a prompt that read: "" (or anything
thing else they didn't recoginze?

Wouldn't they have to have a password for that realm and don't you
think they might think "gee, I don't have a password for that

What's missing from this picture?