.htaccess htpassword protect, safe enough?

Question

I'm blocking my site via .htaccess, htpassword. I heard from a friend that it's really a joke and it can be bypassed in a minute. Is that true? What are other methods that I can use to prevent users/bots to reach my site?

Answer 1

Any password protection scheme can be bypassed if your users are using lousy passwords. No technical details can make up for using "password" as your password.

That being said, HTTP Basic Auth over an unencrypted connection is crap: Both the username and password are sent in the clear and can be intercepted by any motivated attacker. Think of it as the Telnet of HTTP authentication protocols.
If you're running all of this on a https:// (SSL-secured) server with no way to get to the password-protected bits in pain-old-http:// mode you're better off, as everything is encrypted traveling over the wire.

In either case, I would suggest using Digest authentication instead of Basic authentication (even over SSL, due to my inherent paranoia). Again, you're still as vulnerable as your most guessable password, but that's a policy problem for you to solve :)

http://httpd.apache.org/docs/1.3/howto/auth.html has some more details on all of this (old, but still valid), and you can probably turn up more by googling "HTTP Auth security" and flipping through the results.

Answer 2

One specific problem with it is that it's plaintext authentication, i.e. the username and password are sent in the clear across the network, unless you're connecting over HTTPS.

Also, there's no real attack countermeasures built in, you can brute force requests against it all day and it won't block the connection.

To prevent bots accessing your site you can use robots.txt: http://www.robotstxt.org/

Google et all respect this file but if you're talking about hack bots, it won't help.

htaccess authentication isn't exactly secure but its probably better than using a PHP script to authenticate, which will have the same issues but add in the extra layer of PHP vulnerability.

If you use htaccess authentication, along with a specific whitelist IP address range ('Allow from'), and connect over HTTPS I would consider that reasonably secure. For extra security you could configure the IP whitelist at the firewall level rather than Apache level.