使用cmd中的设置http_proxy保护凭据

Question

I was trying to install Rubygems on my Windows 7 machine and had to authenticate myself with a corporate proxy server. I saw several people on various forums with the same problem, and the common solution seemed to be

set http_proxy=http://username:password@www-domain.com:80

While this did work for me and allowed me to download the Rubygems that I needed, I spoke with a security professional about the security of typing the password in plaintext like that, and he did a packet capture with Wireshark and was able to see my credentials. Is there a way to pass credentials in securely through the command line? I know that a lot of other Ruby developers at my company would like to download gems and need a way to authenticate themselves, but I'd prefer to find a secure solution before I help anyone else out.

Answer 1

No, because you connect with http to your proxy, the crendials will be send in cleartext by design.

If your company cares about security, you should connect via https:// to your http proxy.