2 ms·

> If we were making the HTML spec today… can you image a world where the login sign up and forgot password features were in the GUI of the browser itself? This

• eterm 4y ago
  I think the security of basic auth killed it off. 1. Usernames and passwords sent clear text in URLs. 2. Hijacking is worse than cookie hijacking because you get the permanent credentials with no way to force session invalidation 3. Credentials would be cached (and visible) in browser history It was a byproduct of the early web and isn't fit for purpose.
  • yamtaddle 4y ago
    Credentials are sent in headers, and http-auth supports a bunch of schemes other than basic. Browsers have (shitty) UI for taking the username and pass, you don't have to put it in the address bar (and that's been discouraged for years and years). There's no reason whatsoever the feature couldn't have been improved and promoted over the years such that there would rarely be a reason to use anything else. The Web's failure here has been a remarkably expensive misstep for the software economy.
    • qbasic_forever 4y ago
      There's no concept of forgot my password or ID with browser auth. People tried using it years and years ago and it just never evolved into something usable by the general public.
      • yamtaddle 4y ago
        Yes, it definitely should have been maintained and improved over the years.