Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you develop web apps, don't do this.

sneak.datavibe.net

Post reply on HN
Print view View original

111–113 of 113 posts

Re: If you develop web apps, don't do this.

#111

Post by Locke1689 »

uxp wrote: post #110
Locke1689 wrote: post #92

Earlier quoted context omitted.

Whoever downvoted me is apparently unaware of encrypted protocols like SMTP w/ TLS (which most major webmail providers use) and IMAP (which is increasingly preferred over POP3).

IMAP is an unencrypted protocol (as well as SMTP and POP3) in the same regard that HTTP is not HTTP + SSL. All three mail protocols can be wrapped nicely inside SSL/TLS, but it is only point to point encryption. If I connect to my SMTP server over TLS and send you a message to your server, I cannot guarantee that your SMTP server is listening on the secure ports, let alone serving IMAP or POP3 over SSL to your client…

IMAP is an unencrypted protocol (as well as SMTP and POP3) in the same regard that HTTP is not HTTP + SSL. All three mail protocols can be wrapped nicely inside SSL/TLS, but it is only point to point encryption.

This is true, but most major providers only offer IMAP over SSL IIRC.

If I connect to my SMTP server over TLS and send you a message to your server, I cannot guarantee that your SMTP server is listening on the secure ports, let alone serving IMAP or POP3 over SSL to your client, which can be intercepted. Never mind the fact that 45%+ of all mail servers are storing these messages in plain text in /var/mail/

True but once again I think all the major email providers use SMTP over SSL.

Re: If you develop web apps, don't do this.

#112

Post by skrish »

scoot wrote: post #83
sssparkkk wrote: post #72

Earlier quoted context omitted.

> I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system. Exactly. And I think it's somewhat dangerous for the author of the article to not understand this important distinction and at the same time advise creators of web apps to implement this behavior. Judging by the amoun…

It's getting upvotes because the title says "don't do this". People are voting for the fact that the article is offers bad advice. The author however doesn't seem to have quite grasped this - thanking us for his position on the HN front page!

I upvoted it for the value of discussion in the thread than for the article itself. :)
Post reply on HN