3 ms·
The point is to prevent your actual password from being sent in the clear. Yes your session could still be hijacked, but most websites will at least require yo
by nuclear_eclipse 16y ago
The point is to prevent your actual password from being sent in the clear. Yes your session could still be hijacked, but most websites will at least require you to re-enter your password (over SSL) to change your key profile attributes or password, meaning the most someone can do with a hijacked session is vandalize the site from your account. If they have your password via sniffing, they can instantly do a whole lot more, especially if you use the same password everywhere, regardless of the merits of doing that.
- Groxx 16y agoI'll probably get slammed for this, but they do accept OpenID. Though that does nothing for session-jacking.
- mrduncan 16y agomost websites will at least require you to re-enter your password (over SSL) to change your key profile attributes or password While that is the case for most sites, HN doesn't require you to enter your current password when changing your password (or any other information for that matter).