4 ms·
Then a password UI that can't be forged could be used, but I agree if you're going to do it, do it right.
by jules 16y ago
Then a password UI that can't be forged could be used, but I agree if you're going to do it, do it right.
- tptacek 16y agoHave you considered how hard it would be to create a password FORM input that couldn't be forged?
- goran 16y agoSo....let's just discard with web security altogether.
- tptacek 16y agoHard problems don't become more tractable just because you get angry at them.
- metageek 16y agoHow about this: if focus is in a password field, then you get a visual signal somewhere in the chrome--e.g., the color of the location bar changes. Something that HTML+JS just can't do.
- tptacek 16y agoWe can't train users to look for a lock icon to see if they're SSL encrypted, so I'm not optimistic that something as subtle as a URL bar change is going to guide them to secure password inputs.
- sidek 16y agoConsider this, then: a secure password box is put at the very very bottom of the page in an obscure location. JS is used to make a fake one that is prominent. How will you deal with that?
- jules 16y agoYes: trivial. Have the user type in an area outside the page.