I won't get tired of mentioning this - the basic authentication dialog should show a message from the server that is supposed to inform you what kind of credentials to enter. This is super useful for intranets, spam prevention systems and other stuff. Chrome removed this message years ago because of a dubious security report, and Firefox appears to have finally given in and removed it as well. All because someone could MITM your connection and present a login prompt à la "please enter your YouTube credentials" (completely ignoring that if they MITM you, they could serve you a page that really looks like a login page). This change completely ruined the usability of basic authentication.
The MITM part is, in my opinion, an unimportant invention of the original reporter. The change was made because the basic auth dialog is part of the browser chrome (i.e. UI not part of web pages). This UI often looks like part of the browser/OS (especially in legacy IE, but modern browsers also show it differently, with the dialog partially obscuring the bookmarks toolbar. You don’t need a MITM attack for this to go wrong, all you need is a rogue ad or something redirecting you to the attacker’s site. Users might think “the dialog is asking me for my Google password, and it’s presented by the Google Chrome browser, so it’s got to be legitimate.”
That is true, but let's also not forget that the bug title is "HTTP basic auth credentials prompt should make the origin stand out more" and nothing has been done about this in the last 7 years. Instead of making it stand out that the text is coming from the server, they just removed it completely. I found the original prompt to be pretty clear already ("the server asks for a username and password, it says: ...") but I'm sure in all these years they could have brought it back and made it more obvious that it's not Chrome asking for these things.
That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.
Browsers should have standardized a lot more interfaces IMO. We now let developers run wild, which is a lot more insecure. The reasoning behind removing this feature is asinine considering Google does permit this, but they only want you to use it to login to your browser for Google accounts. Another shortcoming of browsers is that their integrated bookmark and password managers are pretty terrible, but if you want to integrate your own they want you to use your own extension interface while not being able to replace the ones that they provide.
Comments
I won't get tired of mentioning this - the basic authentication dialog should show a message from the server that is supposed to inform you what kind of credentials to enter. This is super useful for intranets, spam prevention systems and other stuff. Chrome removed this message years ago because of a dubious security report, and Firefox appears to have finally given in and removed it as well. All because someone could MITM your connection and present a login prompt à la "please enter your YouTube credentials" (completely ignoring that if they MITM you, they could serve you a page that really looks like a login page). This change completely ruined the usability of basic authentication.
I found the bug you’re talking about: https://bugs.chromium.org/p/chromium/issues/detail?id=544244
The MITM part is, in my opinion, an unimportant invention of the original reporter. The change was made because the basic auth dialog is part of the browser chrome (i.e. UI not part of web pages). This UI often looks like part of the browser/OS (especially in legacy IE, but modern browsers also show it differently, with the dialog partially obscuring the bookmarks toolbar. You don’t need a MITM attack for this to go wrong, all you need is a rogue ad or something redirecting you to the attacker’s site. Users might think “the dialog is asking me for my Google password, and it’s presented by the Google Chrome browser, so it’s got to be legitimate.”
That is true, but let's also not forget that the bug title is "HTTP basic auth credentials prompt should make the origin stand out more" and nothing has been done about this in the last 7 years. Instead of making it stand out that the text is coming from the server, they just removed it completely. I found the original prompt to be pretty clear already ("the server asks for a username and password, it says: ...") but I'm sure in all these years they could have brought it back and made it more obvious that it's not Chrome asking for these things.
It is because the only "native" login they want you doing is to their sync services.
That can't be true. Every browser vendor has happily implemented WebAuthn, which is easier to use than basic auth, and is actually secure. With a few lines of Javascript, you get native auth (FaceID, Windows Hello, etc.) and hardware tokens (YubiKey over USB or NFC), and you don't involve any external services; just you and the browser. Implementing this was a ton of work that detracts from things like "Log in with Apple" or "Log in with Google", but they did it anyway, which kind of goes against your premise.
Basic Auth just sucks. It's hard for users to understand, and everyone stopped using it as soon as cookies became a thing.
Tell me this, can a user still use an external password manager with WebAuth or maintain the password themselves, or does it require the user to have their OS generate and store the key? From what I can tell, this looks more like an industry effort to have users integrate their passwords into various major-players sync services which is far from ideal for many users who actually want some control over where their passwords are stored and how they are generated.
It doesn't integrate with password managers. You can use your YubiKey or similar that is enrolled with one device on another device (even with another protocol; USB on your computer, NFC on your phone).
As far as I can tell, it doesn't integrate with any sort of platform-level sync, either. My tablet doesn't get my phone's credentials; it has to be independently enrolled.
Browsers should have standardized a lot more interfaces IMO. We now let developers run wild, which is a lot more insecure. The reasoning behind removing this feature is asinine considering Google does permit this, but they only want you to use it to login to your browser for Google accounts. Another shortcoming of browsers is that their integrated bookmark and password managers are pretty terrible, but if you want to integrate your own they want you to use your own extension interface while not being able to replace the ones that they provide.