4 ms·
I find this measure ill conceived. It only protects from unlocked computers and sniffed session cookies. The right way to handle these two problems is to religi
by sdfjkl 13y ago
I find this measure ill conceived. It only protects from unlocked computers and sniffed session cookies. The right way to handle these two problems is to religiously lock your computer when you step away and to serve nothing on port 80 but a permanent redirect to port 443.
As spindritf pointed out, it merely serves to annoy (or worse, forces passwords to be transported via system clipboards which tends to increase the security risk).
- elliotanderson 13y agoHow would serving everything through SSL and "enforcing" workstation locks on people mitigate XSS and CSRF attack vectors? Requiring additional privilege elevation drastically reduces this.
- sdfjkl 13y agoThose are already solved by using CSRF tokens and escaping all the things. Still no reason to bother users with additional password prompts, which come with a number of risks of their own, not least of all causing users to use weaker or shared passwords because they have to enter them all the bloody time.
- charleslmunger 13y agoHTTP Strict Transport Security is a must also.