On Fri, 2009-07-17 at 17:14 +0300, Jussi Paju wrote:
> On Fri, 17 Jul 2009, Jonathan Weiß wrote:
>
> > Why do you think GET is not safe? Of course, you can also use the POST
> > command, but if you want to secure the transfer, you will need to use
> > SSL to encode the data.
>
> I thought the same when I implemented my login and came to the
> conclusion that I simply do not want to have plaintext passwords in
> servers access_log, that's why I rather POST.
Jussi and Matthias,
While the server log is an important security concern, using unencrypted
transmission (http) for sending the password can still allow the packets
to be intercepted along the way and the password read in plaintext, even
if the server log doesn't record the password. This interception of the
request body can even happen at the server if your server is ever
compromised with malware. Without encryption, the password is sent as
plaintext data within the request body. So, as Jonathan wrote, the only
way to truly be secure (if that's your concern) is to send the password
POST request using secure http through SSL. Of course, this will
require that you purchase an SSL certificate for your server address
unless you create a "fake" one for testing purposes through certificate
utilities in the OS. Note that a "fake" certificate will result in a
browser warning about the invalid certificate, but you can choose to
allow the https request anyway.
If you're not familiar with the details of https requests, you better do
some reading on the web in order to address your security concerns.
It's well worth the effort, and we should all have the concern for
security that you're expressing here. I applaud you for your attention
to this detail, as we too often ignore these details when trying to get
an application developed and deployed - I'm guilty of this crime myself.
HTH,
Gene
> --
> Jussi Paju
> - luoja, creator -
>
> :: Te audire no possum. Musa sapientum fixa est in aure.
> :: I can't hear you. I have a banana in my ear.
> ------------------------------------------------------------------------------
> Enter the BlackBerry Developer Challenge This is your chance to win up to
> $100,000 in prizes! For a limited time, vendors submitting new applications
> to BlackBerry App World(TM) will have the opportunity to enter the BlackBerry
> Developer Challenge. See full prize details at: http://p.sf.net/sfu/Challenge
> _______________________________________________
> qooxdoo-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/qooxdoo-devel
------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge
This is your chance to win up to $100,000 in prizes! For a limited time,
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
qooxdoo-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qooxdoo-devel
