Basic WWW-authentication requires 3 elements. The realm is a quoted string provided by the WWW server. A user name and password are required from the user. The user name and password are encoded using Base64 -- an insecure encoding method -- and sent to the WWW server as an authentication ticket. Pwd64 allows you to generate the Base64 authentication tickets. You may then include the ticket and the realm (provided by the WWW server) in the configuration file.
To use Pwd64, run the executable at the command prompt. It will ask for the user name and password. (Note: your password will not be echoed to the screen.)
For example, if your user name is "dr.neal" and your password is "templeton" then you would see:
Pwd64 1.0: Base64 encoding for Basic WWW-Authentication by N.A. Krawetz Copyright 1996-1998. All rights reserved. Enter user name: dr.neal Enter password: base64 encoded: ZHIubmVhbDp0ZW1wbGV0b24= |
Authorize "Very Private" ZHIubmVhbDp0ZW1wbGV0b24=
A note about realms: They are not "unique". It is possible for two different web sites to use the same realm but require different user names or passwords. Even worse, it is possible for different documents on the same web server to require different user names and passwords while using the same realm. This occurs when different people setup their own password protection. Different people may use the same realm name, without thinking of uniqueness. Some common realms we have seen are "Secret", "Password", and "Private".
Unlike DES, PGP, and other cryptographic encoding schemes, Base64 is easily reversable and not meant for privacy. In fact, anyone can download the specifics for Base64 from the web! Your secret password and user name are transmitted in easy-to-decode text across the world every time you access a protected web document. To reiterate: Base64 encoding is not private and not secure.
Other tools that use Base64 encoding include e-mail and news readers which can view Mime-encoded (also called "attached") documents. Mime uses Base64 to encode and decode the document.