4 ms·
Storing the username and password in the cookie is completely ridiculous, but I just want to point out that it doesn't appear as though twitter itself uses SSL
by blhack 17y ago
Storing the username and password in the cookie is completely ridiculous, but I just want to point out that it doesn't appear as though twitter itself uses SSL either.
Unless I'm completely missing something, neither does facebook, or reddit, or hacker news, or really any other website other than my bank.
edit: I had a complete lapse of thinking here and am totally wrong about this. There are still lots of websites that do not use SSL, but twitter and facebook are not among them, nevermind.
- a2tech 17y agoMany websites post the forms to encrypted sites. Facebook and others do this-I haven't looked into hacker news or reddit.
- kogir 17y agoThis doesn't do any good because the page that contains the form can be transparently altered to post somewhere else by a man in the middle.
- revetkn 17y agoSaying that it doesn't do any good might be a bit strong - it's still vulnerable, but much less so than straight-up POSTing over an unencrypted channel.
- tptacek 17y agoYou're right in the general case, but in the API case it doesn't matter how the form is rendered because API clients don't parse forms.
- blhack 17y agoIt doesn't look like reddit or hacker news do. reddit: <form method="post" id="login_login-main" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" class="login-form-side"> HN: <form method="post" action="/y">
- revetkn 17y ago...but reddit's only 91 lines of lisp, what did you expect?
- IgorPartola 17y agoThanks to OpenID I don't have to worry about some of that.