On Compromising Password-Based Authentication over HTTPS

SSL (secure socket layer) is one of the security protocols to achieve secure communications over a TCP/IP network. SSL has two types of authentication modes, server authentication mode and client authentication mode. The former is popular and facile to utilize, while the latter is secure enough owing to mutual authentication. However, when it was required to identify a client or its user, server authentication mode can be utilized with basic authentication, which is authentication with password to achieve mutual authentication. In this paper, we discuss the compromising of authentication using the password-based authentication over SSL. And we show the counter-measures against the attacks