3 ms·
You've responded as if the bit you've quoted is advice to individual developers in the present context, but the topic of conversation was about extending browse
by dllthomas 5y ago
You've responded as if the bit you've quoted is advice to individual developers in the present context, but the topic of conversation was about extending browsers so that the standard login form would do this (... better than existing auth digest). If we did that and people were used to using the browser's built-in login dialog, and (as with https) we made it visible what security features were enabled, then a trivial server-side change wouldn't compromise user passwords.
- gjsman-1000 5y agoRight... that would be awesome. But it would still be susceptible to a hacker replacing it with a traditional login page with some logging... unless somehow you could prevent any traditional web pages from working.
- madacol 5y agoAnd users WILL NOTICE before that happens Please, stop using those strawman arguments
- dllthomas 5y agoSome users will notice. If we've succeeded to the point of "traditional login pages" being unusual and remarkable, many users will notice. Probably in any case some users will fail to notice. In any case, though, it seems likely to reduce the impact of a compromise.
- gjsman-1000 5y agoI beg to differ. You'd be surprised how many users probably would not recognize any difference whatsoever as long as the hacker got things looking relatively identical.