Re: [PATCH] Support username and password inside URL

Kalle Valo [off-list ref] writes:

Currently usage of curl was so that netrc was mandatory and passwords in URL
weren't allowed. Change netrc to optional to make HTTP basic authentication
with username and password in URL also work.

HTTP "basic"?  Let's at least say "digest" for starters ;-).

I am modestly against letting users use auth-embedding URLs, and
fairly strongly against encouraging users to do so.

It is handy to have weak "authentication" in some situations.  I
am not ashamed to admit that I've used security-by-obscurity
myself, when I sent an email to a friend, saying:

        Hi, I have some pictures I took during our last trip
        together, but due to their size I am not attaching them
        to this e-mail.  Please pick them up at:

	        http://members.cox.net/junkio/r0ZIEF/5S54m/

        Please drop me a note after picking them up, so that I
        can clean-up the directory.

Auth-embedding URLs are about as secure as the above URL, but it
is worse because they may tempt you to reuse the same username
password pair for other purposes later.

If you are using the password protected URL yourself, I'd
imagine having them in your netrc would not be such a big deal,
so I suspect your expected usage is not for yourself, but more
like giving a temporary, even one-shot, access to others like
the above example, and making it more convenient for them (even
in that case, if it is not one-shot but for repeated use, I'd
imagine it would not be such a big deal to ask them to do
appropriate netrc).  If that is what is going on here, then
IMNSHO it would be better to make it clear that you are doing
security-by-obscurity by not using username password pair, which
makes you pretend that you are doing _some_ security.