|
And here the description I found in the Net:
User Authentication
The only option under User Authentication is Logon, as Figure 3 shows. Logon controls how IE responds when a Web server requests authentication. Web servers such as Microsoft Internet Information Server (IIS) support the NT LAN Manager (NTLM) Challenge Handshake Authentication Protocol (CHAP). IE uses CHAP to authenticate the user to the Web server using the username and password that the user specified when he or she logged on. You can manage access control on intranet Web servers based on the user's domain account, which is transparent to the user. But because a malicious Web site operator can trick IE into responding to a NTLM challenge, using an NTLM challenge on the Internet is dangerous. The attacker can use a tool (e.g., L0phtCrack) to obtain the password by cracking the response. For an even more sinister, targeted attack, a malicious intruder can send an email with a link back to the attacker's Web site, which sends an NTLM authentication challenge when the user clicks on the link. If the systems administrator has not configured IE securely, the onsite server encrypts that challenge with the user’s password hash as the key and sends it back as the response. The attacker then feeds the challenge and response pair into L0phtCrack to crack the user’s internal domain password.
Therefore, I recommend that for communicating with computers outside your trusted network, it's important that you don't use the Automatic logon with current username and password setting. For your Intranet zone (and perhaps Trusted sites zone, if you use that zone for business partners in an extranet scenario), I recommend that you set Logon to Automatic logon only in Intranet zone. For your Internet and Restricted sites zone, you should use Anonymous logon or Prompt for user name and password. If you select Anonymous logon, IE won’t respond to authentication requests.
If you select Prompt for user name and password, IE won’t automatically respond to authentication requests with the user’s domain credentials; instead, IE displays a window asking the user for credentials.
<<<=== the window of htaccess !!! asking for username and
password
Thats it!!!!!!
 |
 |
| Niemals!!! ein
Häkchen bei "Save this pass...." |
oder "Remember
my password" |
| dann würde dein username und
passwort auf dem PC gespeichert werden und ein anderer könnte sich
automatisch anmelden!!!!!!!!!! |
und deine Daten in
admin ansehen!!!! |
hier nochmal in deutsch:
Internet Explorer/Windows kommt nicht auf ein passwortgeschütztes Verzeichnis.
Fehlermeldung des Browsers:
"Authorization Required
This server could not verify that you are authorized to access the document
requested. Either you supplied the wrong credentials (e.g., bad password),
or your browser doesn't understand how to supply the credentials required"
Schaut mal in den Internet Explorer-Settings nach. Ich weiß nicht, wie das bei anderen Versionen ist,
aber in der IE Version 6.0 gibt es in Extras->Optionen->Sicherheit Internet, dann "Stufe anpassen"
den Punkt "Benutzerauthentifizierung". Dort muss man bei 6.0 in solchen Fällen wohl
nach Benutzername und Kennwort fragen wählen.
Ich hoffe, das es nun klappt!!!!
|