4 ms·
The main problem isn't the response, the problem is that on the initial request, the insecure password will be sent in plaintext.
by rb2k_ 14y ago
The main problem isn't the response, the problem is that on the initial request, the insecure password will be sent in plaintext.
- deleted 14y ago[deleted]
- drivebyacct2 14y agoIsn't this sort of issue basically only going to happen during development or such?
- barredo 14y agoBut that's not the problem of the API provider. If you explain that you only allow HTTPS and someone makes an HTTP on an unsecured connection, well...
- smtddr 14y agoOh but it IS the problem with the provider. Or rather, it will be when some crazy PR storm hits the interwebz with "$YOURCOMPANYNAME leaked passwords!" when someone comes up with some clever way to hack/manipulate traffic with XSS or something. I was able to fetch private authtokens of a Wii game because port 80 was open on one of nintendo's servers(I assume it's there to test in plain text and just didn't close it later) and I was able to fool the software into using port 80 instead of port 443. That wouldn't have worked if port 80 was closed.
- barredo 14y agoMakes total sense. Thanks
- burrows 14y agoPretending that your customers won't make mistakes? Sounds insecure.