Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread German Geek
OK, i hear about this self signed certificate. Whenever i signed anything it just came up with all these warnings in FF which confuses users and i think is not good at all. Can someone paste a link in here to a website with a self signed cert please? Would like to see if there are any warnings

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread Michael A. Peters
German Geek wrote: OK, i hear about this self signed certificate. Whenever i signed anything it just came up with all these warnings in FF which confuses users and i think is not good at all. Can someone paste a link in here to a website with a self signed cert please? Would like to see if there

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread German Geek
Hi All again, What makes it so expensive to have a certificate? I mean, wouldn't it be possible to setup a new authority that doesn't charge as much or nothing at all? Wouldn't the major browsers be willing to support an authority that is free or costs next to nothing? I pay about $200 a year for

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
German Geek wrote: What do you think? I think just use a flippin' ssl server and be done with it. When I go to a website that requires me to let them execute JavaScript I rarely go back. You can use SSL for the login and only the login - I know that it means either using a self signed

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Per Jessen
Michael A. Peters wrote: German Geek wrote: What do you think? I think just use a flippin' ssl server and be done with it. That was my thought too. You can use SSL for the login and only the login - I know that it means either using a self signed cert or paying big bucks, for

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Dotan Cohen
I think just use a flippin' ssl server and be done with it. ++$i When I go to a website that requires me to let them execute JavaScript I rarely go back. Many people do this, I hope that the OP realizes this. You can use SSL for the login and only the login - I know that it means either

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
Dotan Cohen wrote: Have you seen the fit Firefox 3 makes for self-signed certs? So far as the end user is concerned, the site is inaccesible. Yes I have. That's why on my site I have an instruction page - and a demonstration of how Opera does it, which is just as secure and less of a PITA,

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread German Geek
Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Of course it's not for banks etc. You could degrade gracefully when javascript is turned off to just sending the form and

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
German Geek wrote: Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Sites (like mine) that don't want to pay a certificate authority can use a self-signed cert. Even Red

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Sudheer
Michael A. Peters wrote: German Geek wrote: Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Sites (like mine) that don't want to pay a certificate authority can use a

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Sudheer
Firefox scares its users when they encounter a website with self signed certificate. If your website users aren't worried about the warning Firefox throws at them, self signed cert works well. I just realized Dotan Cohen already mentioned this. -- With warm regards, Sudheer. S

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
Sudheer wrote: Michael A. Peters wrote: Sites (like mine) that don't want to pay a certificate authority can use a self-signed cert. Even Red Hat does for some of their stuff (IE I believe their bugzilla server) Firefox scares its users when they encounter a website with self signed