4 ms·
To make this more clear, here is the Network tab under Developer Tools when I log into twitter: http://cl.ly/image/3f3x3R0N0y2W http://cl.ly/image/3f3x3R0N0y2W
by harryh 14y ago
To make this more clear, here is the Network tab under Developer Tools when I log into twitter:
http://cl.ly/image/3f3x3R0N0y2W http://cl.ly/image/3f3x3R0N0y2W
If I had actually logged in you would see my password in the space that currently says NotActuallyMyPassword.
I don't see how Meldium could prevent that.
- soumyadeb 14y agoThis can be done using SSL proxying. You can run a proxy server and send the HTTP login POST request (with a fake password) through the proxy server. The proxy server can in turn replace the fake password with the actual password and forward the POST request to the end website. It is also possible to run the proxy server on the end user machine and use a mechanism called SSL tunneling to securely replace the password. Its hard to explain it here but it can be done. The benefit of running the proxy on the end user machine is that you don't have to route your traffic through a remote proxy. I have a system which has this thing working - will open-source it under github soon.
- stanleydrew 14y agoI doubt it's a local proxy since it's a Chrome/FF extension. Or maybe I've not kept up with the state of Chrome/FF extension development and it is completely possible to write a proxy that runs within the browser.
- Hello71 14y agoExtensions don't proxy anything. They do, however, have access to everything you do (type, click, etc) and everything you can see. (i.e. close enough)
- pixelcort 14y agoAccording to http://news.ycombinator.com/item?id=5282855 http://news.ycombinator.com/item?id=5282855 it looks like they log in and get a session cookie for the site on their side and send that to your browser.