Hacker News Reader

HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.

View on HN

How so? Over SSL? (Note that you should never call anything requiring authentication/authorization over plain HTTP.)

A quick Google suggests you're right, as in either case you must run SSL/TLS.

Appypolylogies.

Reply on news.ycombinator.com