cURL / Mailing Lists / curl-library / Single Mail


Re: problem using NTLM authentication with default OS credentials

From: David Woodhouse <>
Date: Sat, 12 Jul 2014 17:00:47 +0100

On Fri, 2014-07-11 at 15:50 +0200, Michael Osipov wrote:
> I my opinion, we can refer to the HTTP standard which mandates to use
> strongest to weakest auth. So curl would actually need to priorize
> authentication and try in that order:
> Kerberos > Negotiate > Digest > NTLM_WB > NTLM > Basic.
> KRB 5 comes before SPNEGO, bcause it can downgrade to NTLM which is less
> secure. Digest comes before NTLM because, again, less secure and
> proprietary.

Another point of view would be that NTLM_WB comes before Digest. You are
focusing on the protocol on the wire, which is too narrow.

In the grand scheme of things, automatic authentication with single sign
on *has* to be better than making the user pass a password around to
curl in cleartext so that it can do the Digest auth for itself.


List admin:

  • application/x-pkcs7-signature attachment: smime.p7s
Received on 2014-07-12