I’ve been spending a lot of time looking at the best options for getting authenticated RSS and Atom feeds with a free reader. Here are the factors to consider:

• HTTP
  Standard protocol for the web. All information is sent “in the clear”, so a snoop can see what you are looking at with no effort. 99% of all feeds use this, so every reader out there supports it.

• HTTPS
  Standard secured protocol for the web. All information is encrypted, so a snoop can’t see anything useful if he monitors your connection. Unfortunately, the encryption is going to slow everything down. Only a handful of readers support this.

• Basic Authentication
  Common way to require username + password to access information. Unfortunately, when you type the password it is sent without any encryption, so a snoop can see your password with no effort. The only way to mitigate this problem is using it over HTTPS so that the password is naturally encrypted for you. This is a viable solution for non-Windows servers.

  Several readers support basic authentication, but not when combined with HTTPS. If you don’t combine the two, you haven’t got a secure solution.

  I should mention that some readers claim basic authentication support if you will pass the username and password along in the url like this: http://foo/rss?username=bob&password=secret . This is, frankly, a ridiculous thing for any server to allow and be called secure. The password is now in plain sight from your browser history to a proxy server to the destination server and any snoop along the way. Don’t bother.

• Digest Authentication
  Windows Servers use this to require username + password when tied to an Active Directory infrastructure. The password is not sent in the clear, so using it with HTTP is okay, unless the stuff you’re going to look at needs to be secured as well.

  Very few readers I’ve found can handle this.

• NTLM Authentication
  Windows Servers uses this to require username + password when tied to a domain infrastructure. This is a hard nut to crack because the NTLM spec isn’t publically available. This is theoretically even more secure than Digest, and the password is also never revealed. Using this with HTTPS is probably the most secure your information can be on a Windows Server.

  Since this is the big brother to Digest, usually only the (very few) readers who can handle Digest also handle NTLM.

There are a couple of lists of “which readers can do what” out there, but my own experience has proven to be at odds with the officially publicized capabilities. I have tried SharpReader, Bloglines, NewsGator Online, RSSOwl, BottomFeeder, FeedReader, intraVnews (which is not free), and a couple of others I don’t remember offhand.

And the winners of secured feeds are…

• HTTP + Basic: Too many to bother listing.
• HTTP + Digest : NewsGator Online, RSSOwl 1.1 Preview
• HTTP + NTLM: NewsGator Online, RSSOwl 1.1 Preview
• HTTPS + Basic : RSSOwl 1.02
• HTTPS + Digest: RSSOwl 1.1 Preview
• HTTPS + NTLM: None (RSSOwl 1.1 preview crashes)

Interestingly, the forthcoming RSSOwl 1.1 is supposed to handle Digest/NTLM as well, so I’ll be keeping an eye out for it when it is released in the near future. It may well become the defacto free reader for authenticated feeds until everyone else catches up.

Addendum (March 4): Greg of NewsGator fame had a couple of firewall suggestions that seemed to do the trick for HTTP, but not HTTPS. I’ve added NewsGator Online to the list above accordingly. I’ll keep poking around to see if I can get it to work via HTTPS as well.

This entry was posted on Thursday, March 3rd, 2005 at 12:00 and is filed under syndication. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.