3 ms·
My comment about username/password being harvested was talking about how someone's password can get stolen: you can have malware, password reuse across sites, p
by yuliyp 5y ago
My comment about username/password being harvested was talking about how someone's password can get stolen: you can have malware, password reuse across sites, phishing, or other social engineering. For session cookies, you have basically malware as the compromise vector. Hence, passwords should be treated with more suspicion by an authentication system.
- usrbinbash 5y agoAll these attack vectors work regardless of the Authentication system used.
- yuliyp 5y agoThey don't, though. Users don't reuse session cookies between sites, so another site compromised doesn't mean you have to worry about existing sessions being compromised on your site. Users also don't know their session cookies so are far less likely to go typing them in to a phishing site or hand them out over the phone. A password is vulnerable to all of these scenarios.