<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class="">I was thinking about preventing MITM attacker degrading auth to Basic.<br class="">Currently any RTSP client is vulnerable to exposing full credentials in<br class="">plain-text (almost), as there is no way to authenticate server first.<br class=""></blockquote><div><br class=""></div>That’s a good point.</div><div><br class=""></div><div>I’ve just installed a new version (2014.11.07) of the “LIVE555 Streaming Media” software that adds a new method</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>RTSPClient::disallowBasicAuthentication()</div><div>that you can call on a “RTSPClient” object to disallow ‘basic’ authentication if the server requests it.</div><br class=""><br class=""><div class="">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Ross Finlayson<br class="">Live Networks, Inc.<br class=""><a href="http://www.live555.com/" class="">http://www.live555.com/</a></span>
</div>
<br class=""></body></html>