Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Login Forms Over HTTPS, Please

hacks.mozilla.org

Post reply on HN
Print view View original

81–90 of 121 posts

Re: Login Forms Over HTTPS, Please

#81

Post by briandh »

andy_ppp wrote: post #47
bluetech wrote: post #22

I have recently deployed Content Security Policy (CSP) on a website. When I first looked at violation reports, my jaw dropped. The amount of malware (rouge extensions, toolbars, viruses, ...) that is blocked is staggering. If you really want to help your (clueless) users, never ever serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see "Kas…

Yes, I was about to say this - if you have a secure enough content security policy (and the browser in question supports it properly) it will be impossible for an attacker to execute their inserted Javascript (which to be able to do this anyway is also a security vulnerability). But yes, the best plan is to have HTTPS everywhere, something that looks a lot closer than it once did! Thanks NSA!

> if you have a secure enough content security policy (and the browser in question supports it properly) it will be impossible for an attacker to execute their inserted Javascript

I don't follow your reasoning. Why wouldn't an MITM attacker modifying an HTTP response body to insert rogue Javascript also be able to modify the response headers to strip or alter the Content Security Policy?

Re: Login Forms Over HTTPS, Please

#83

Post by [deleted] »

mhw wrote: post #57

I'm puzzled. As a developer the sites I work on are (mostly) going to be hosted on my local machine. I usually don't bother with all the effort to set up SSL certificates for my development web server unless I've got an SSL-specific issue to investigate. Is this feature disabled for sites that are local? If not I'd expect I would just come to ignore it quite quickly. Then when I then look at the production version of…

[deleted]

Re: Login Forms Over HTTPS, Please

#85

Post by jakobdabo »

hackaflocka wrote: post #79

So, if I understand it correctly, HTTPS costs developers money (annual rent for renting an SSL Cert). Google too is about to start shaming non-HTTPS connections (according to a recent article). I've heard about the free one-year Cert. Is there any way to do HTTPS all in-house (permanently), without resorting to an external agency?

https://letsencrypt.org/

Re: Login Forms Over HTTPS, Please

#87

Post by sugarfactory »

What I don't understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn't it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It'd be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why does it have to be a password rather than a public key? The only hindrance is the fact that the protocol doesn't support it.

I have no idea why this easy change hasn't been made in the protocol.

Re: Login Forms Over HTTPS, Please

#88

Post by colanderman »

sugarfactory wrote: post #87

What I don't understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn't it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It'd be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why do…

Check out the abandoned Mozilla Persona, and the SRP protocol.

https://developer.mozilla.org/en-US/Persona http://srp.stanford.edu/whatisit.html

Re: Login Forms Over HTTPS, Please

#89

Post by vertex-four »

sugarfactory wrote: post #87

What I don't understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn't it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It'd be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why do…

There was, fairly recently, a half-hearted attempt to do that in the way of Persona. Unfortunately, neither Mozilla nor any of the other browser vendors implemented it, and the fallback mechanism was very poor UX.

Re: Login Forms Over HTTPS, Please

#90

Post by mankyd »

sugarfactory wrote: post #87

What I don't understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn't it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It'd be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why do…

There are sites that can use keys to authenticate. They're usability is miserable.

Key based authentication is difficult for a layman to manage and understand. May mother can memorize a password and use it across computers. Asking her to do the same with a key will be difficult.

Post reply on HN