Discussion About the Basic Protection Scheme

Because the password flies (almost) unencrypted through the Internet, anyone who is listening to the Internet traffic can find out people's user names and corresponding passwords. Thus this kind of a telnet-level protection only protects from accidental viewing of classified documents.

You migth think of this as a door. If you really want to get in, you can always break the lock, and get what you want, but the bottom line then is that then you have broken something, and that is wrong.

Thus the Basic Protection Scheme only provides the means of telling people that a document is a protected one; it does not prevent the document from being accessed by someone who wants it badly enough to go through the trouble of listening to the Internet traffic, finding out which printable encoding scheme we use, and decoding your username and password.

However, using IP address masking together with usernames ("only these people from these internet addresses") makes it more secure, because an intruder would also have to have access to the machine having the required IP address.

AL 12 December 1993