3 ms·
I think you're missing the fundamental point here - users of this technology will never enter their password online again. Instead, imagine new HTML elements a
by eximius 11y ago
I think you're missing the fundamental point here - users of this technology will never enter their password online again.
Instead, imagine new HTML elements and you could have
<form type="cbcrypt">
<input type="username" />
<input type="password" />
</form>
and the web browser would allow you to enter your credentials in a secure, NATIVE window. (At least secure from web stuff - keyloggers get a lot more powerful under this scheme.)
If it works as advertised, it's quite nice. Personally, I think this is very close to what we need.
I will note I still probably wouldn't use it because if your password is exposed, then you're screwed. It is very close though. A hardware element or something might mitigate this enough.
- jakeva 11y agoOk, but how would a native window prevent an undereducated user from naively entering their password into an attacker's spoofed login form? In my mind this strategy more or less kicks the ball down the field as opposed to revolutionizing security.
- btreecat 11y agoWould this not still be phishable? All an attacker would have to do is make a website look enough like the real thing, then use a plain <form> element and capture the submitted form content. I would think an out of browser app might work better for that task.
- 0x0 11y agoWell, there's always the venerable but little-known <keygen> HTML tag already... :)