3 ms·
I agree it's a pain, although I assume one of the other reasons would be a badly programmed website that does something silly like myImage.src = "http://www.bl
by axod 18y ago
I agree it's a pain, although I assume one of the other reasons would be a badly programmed website that does something silly like
myImage.src = "http://www.blah.com/foo.png?username= http://www.blah.com/foo.png?username="+username+"&password="+password;
The user is under the impression they are secure, and their data is protected from prying eyes, but then the website has gone and given their username and password out over a non secure channel.
So it's not just js/css that could cause leakage/security issues, but any http request.
This is of course the fault of the website for being sloppy with the users private data, but I can see the argument that says users should be made aware that there is a possibility of sensitive data being "leaked".
The issue is: Who do you want to be the authority on what data is "boring generic/doesn't matter", and what data is "sensitive"... The website? or the user?
- ovi256 18y ago>> myImage.src = "http://www.blah.com/foo.png?username= http://www.blah.com/foo.png?username="+username+"&password="+password; No encryption (or technology even) of any kind could protect against that kind of stupidity.
- axod 18y agoWell at the moment, some browsers will warn you when this code executes, as it's loading http, from an https page. Yes it's an extreme example, but there are likely other examples where the data isn't quite so sensitive.
- jrockway 18y agoNo encryption (or technology even) of any kind could protect against that kind of stupidity. Seriously. You can't just interpolate variables into URLs without escaping :)