4 ms·
Many websites post the forms to encrypted sites. Facebook and others do this-I haven't looked into hacker news or reddit.
by a2tech 17y ago
Many websites post the forms to encrypted sites. Facebook and others do this-I haven't looked into hacker news or reddit.
- kogir 17y agoThis doesn't do any good because the page that contains the form can be transparently altered to post somewhere else by a man in the middle.
- revetkn 17y agoSaying that it doesn't do any good might be a bit strong - it's still vulnerable, but much less so than straight-up POSTing over an unencrypted channel.
- tptacek 17y agoYou're right in the general case, but in the API case it doesn't matter how the form is rendered because API clients don't parse forms.
- blhack 17y agoIt doesn't look like reddit or hacker news do. reddit: <form method="post" id="login_login-main" action="http://www.reddit.com/post/login" onsubmit="return post_user(this, 'login');" class="login-form-side"> HN: <form method="post" action="/y">
- revetkn 17y ago...but reddit's only 91 lines of lisp, what did you expect?
- IgorPartola 17y agoThanks to OpenID I don't have to worry about some of that.