I have a question about the security/risk of using basic authentication for an asp.net app.
Scenario: We have an Intranet ASP.NET app that needs to access a file share across the network. We are currently using Basic Auth on the Virtual Directory, with Windows authentication mode and impersonate="true" in the web.config file. Note: I am also looking in to using Kerberos constrained delegation, but my head starts spinning once I get too deep into SPNs, cross-domain trust, etc. So, I think Basic Auth might be my best easiest option.
I have a question regarding the relative 'safe-ness' of using Basic Auth and impersonation as described above to access a network resource (network share). I understand the risk during the first hop (browser to IIS) in that my userid/pass are essentially in the clear text (Wireshark trace confirms this) and that using an SSL cert can remedy this issue. I also ...
Go to the complete details ...