4 ms·
To be fair, all the checks are running in JavaScript on your browser -- your passphrase never leaves your computer. Feel free to packet-sniff to verify :-)
by seldo 14y ago
To be fair, all the checks are running in JavaScript on your browser -- your passphrase never leaves your computer. Feel free to packet-sniff to verify :-)
- lambda 14y agoUntil the author decides to change it to send the passphrases to the server, or someone MITM you and injects code to do the same thing. Basically, it's a bad idea to start typing passphrases into an untrusted, unencrypted web page, regardless of whether it does anything bad right now.
- daeken 14y agoBut you could change that, and you're hosting it on non-SSL, so an attacker could change that too.
- bhousel 14y agoRecommendation to you: Just put the code up on github and share that instead. It's static, so you can even host it on a github page. Write a readme that makes it obvious that this is just a technology demo and not a for-real online password checker. Because sadly people here are too dumb to just 1. read your totally readable javascript source or 2. wget the code and try it out for themselves in a local sandbox (if they are really that worried about MITM). I guess it's way easier to just dash off some negative comment about something that's not even a problem in the first place.
- lsb 14y agoYup, check out https://github.com/lsb/passphrase-safety-ui https://github.com/lsb/passphrase-safety-ui
- mootothemax 14y agoTo be fair, all the checks are running in JavaScript on your browser -- your passphrase never leaves your computer. What's to prevent, e.g., a browser extension from listening in?
- schiffern 14y agoWhat's to prevent a browser extension from listening in on any password? Don't install stuff you don't trust.
- mootothemax 14y agoWhat's to prevent a browser extension from listening in on any password? Don't install stuff you don't trust. I didn't mean to imply otherwise; merely that the author shouldn't claim that their site is 100% safe just because it's Javascript running in the browser.
- mikeash 14y agoBy the time the packet sniffer says that my password has been compromised, it's too late to do anything about it. I suppose I could come up with a new password, test it while watching for no network traffic, and if there was none then go ahead and use the password. I'd rather teach people not to type their passwords into random web sites, though.