3 ms·

Putting your password in plaintext is unacceptable because exposes it to anyone who may be sniffing your traffic. Your search history is already visible to anyo

by wtracy 11y ago

Putting your password in plaintext is unacceptable because exposes it to anyone who may be sniffing your traffic. Your search history is already visible to anyone sniffing your traffic, so it's presence in the URI is moot. I guess my point is that there's a continuum here. There's already other ways for this data to leak (it's already plaintext on the wire, and it's already there in your browser history) and this particular attack vector is easy to mitigate if you put just a little effort into it.

simoncion 11y ago
> Putting your password in plaintext is unacceptable because... I know that. :) dogma1138 said: > ...given all the other dark magic that is in the URL which can include your client type, version, location and other things (e.g. inter-service referrals if you go there from another google service like Google Maps) i think the original query is the least of your worries. There are people for whom and situations in which having a search query exposed is utterly disastrous. I asked the question I asked in order to determine if dogma1138 held the opinion that * "URL's are not implicitly intended to be shared outside of the scope of your application" [0], and therefore any sensitive information in them is 100% okay, because -in his world- noone ever shares hard-to-read URLs anyway or * URLs can have potentially disastrously sensitive information in them, as long as it's not username and password or some other opinion. In short, this was an information-gathering question designed to test the bounds of a hypothesis that I was forming, but did not yet have enough information to put any faith into. :) [0] https://news.ycombinator.com/item?id=10467919 https://news.ycombinator.com/item?id=10467919
kps 11y ago
> Your search history is already visible to anyone sniffing your traffic http://google.com/ http://google.com/ normally redirects to https. It's possible to access Google over HTTP, but it's not typical.
leni536 11y ago
> Putting your password in plaintext is unacceptable because exposes it to anyone who may be sniffing your traffic. I thought query strings are encrypted in a https request.

by wtracy 11y ago

simoncion 11y ago

> Putting your password in plaintext is unacceptable because... I know that. :) dogma1138 said: > ...given all the other dark magic that is in the URL which can include your client type, version, location and other things (e.g. inter-service referrals if you go there from another google service like Google Maps) i think the original query is the least of your worries. There are people for whom and situations in which having a search query exposed is utterly disastrous. I asked the question I asked in order to determine if dogma1138 held the opinion that * "URL's are not implicitly intended to be shared outside of the scope of your application" [0], and therefore any sensitive information in them is 100% okay, because -in his world- noone ever shares hard-to-read URLs anyway or * URLs can have potentially disastrously sensitive information in them, as long as it's not username and password or some other opinion. In short, this was an information-gathering question designed to test the bounds of a hypothesis that I was forming, but did not yet have enough information to put any faith into. :) [0] https://news.ycombinator.com/item?id=10467919 https://news.ycombinator.com/item?id=10467919

kps 11y ago

> Your search history is already visible to anyone sniffing your traffic http://google.com/ http://google.com/ normally redirects to https. It's possible to access Google over HTTP, but it's not typical.

leni536 11y ago

> Putting your password in plaintext is unacceptable because exposes it to anyone who may be sniffing your traffic. I thought query strings are encrypted in a https request.