Kerberos and HTTP / HTTPS - Could Kerberos tickets be intercepted and misused?

[Eichhorn, Thomas]

Hi,

We use Kerberos for SSO in our local intranet. We followed this tutorial: http://www.grolmsnet.de/kerbtut/
Everything works just fine.

I have a question about security:

Our intranet sites are delivered with HTTP. Can someone intercept the Kerberos ticket and use it for himself?


Thanks in advance

Thomas
________________________________


Klinikum Nürnberg, Sitz: Nürnberg, Amtsgericht Nürnberg -Registergericht- HRA 14190, Vorstand: Dr. Alfred Estelmann