4 ms·

I'm no expert... but what if just the javascript was served via https? Maybe somebody ought to put an MD5 javascript library on an https server as a public ser

by brfox 18y ago

I'm no expert... but what if just the javascript was served via https? Maybe somebody ought to put an MD5 javascript library on an https server as a public service. Or would js hashing still be vulerable since the man-in-the-middle could change the nonce or something?

ben_h 18y ago
If you're going to serve Javascript over SSL, you need a full SSL setup including a valid certificate, etc. If you have that, you may as well just serve the login form itself over HTTPS, redirecting back to HTTP after logging the user in, and forget the Javascript altogether.
- ComputerGuru 18y ago
  He means someone set up a a JS library over HTTPS on a server for _others_ to use. Like you would grab a JS library off of Google's HTTPS servers and use that on your non-SSL pages.
  - tptacek 18y ago
    Uh... and the page that includes the JS, which is part of your app... comes from where?
    - brfox 18y ago
      Oh yeah, good point!
DougBTX 18y ago
You can inject JS into the HMTL directly.