4 ms·
> Additionally, what about addressing insecure forms that fail to utilize https. FWIW, Firefox detects insecure login forms and emits a security warning to the
by handsomeransoms 12y ago
> Additionally, what about addressing insecure forms that fail to utilize https.
FWIW, Firefox detects insecure login forms and emits a security warning to the web console. This is aimed at developers, however, not users (because the developers are the only ones who can improve the situation).
Our heuristic is imperfect as well. We simply detect <input type="password"> fields on http pages. This works well enough. Trying to detect when developers are abusing <input type="text"> for a password field is non-trivial.
- cpeterso 12y agoHow long has Firefox been logging security warnings (in the web console) for insecure login forms? Do you know of telemetry about how prevalent the problem is or whether the security warnings have helped? I assume, for compatibility, Firefox will never be able to simply reject insecure login forms.
- Excavator 12y agoIt looks like it's been around half a years¹. There's also a reference to the Chromium bug² for implementing the same there. There's also mixed content blocking³ which is a similar but user facing feature. 1: https://bugzilla.mozilla.org/show_bug.cgi?id=762593 https://bugzilla.mozilla.org/show_bug.cgi?id=762593 2: https://code.google.com/p/chromium/issues/detail?id=327032 https://code.google.com/p/chromium/issues/detail?id=327032 3: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/ https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...