In other words, it's not enough to capture the keydown event. They have broken native browser functionality and made it less secure - for negligible gain. (That's not to speak of the free, simple and secure HTTPS solution available, ahem LetsEncrypt ahem)
This actually hashes the password with a salt which atleast avoids sending the password in clear text.
Having a governmental/"big company" hackable security solution wasting many gigawatts and countless hours (ahem LetsEncrypt ahem) is sad.
Instead build your own security IF and WHEN you need it.
But you can keep encrypting those un-cacheable images if you want, and good luck debugging that HTTPS stream!
The same goes for HTTP/2 (only moves head-of-line issue to the TCP layer) and WebSockets (completely over-engineered solution to an already solved problem, see comet-stream).
Main issue is with UX - password manager integration? Nope. Pasting? Nope. Avoiding a warning "insecure form" on an insecure form? Well yeah. Here, have a cookie.
Countless hours? Took me all of 15 minutes. Debugging HTTPS? Fiddler.
Thx, I like cookies, talking of cookies; did you know they are going to remove those "We use cookies, do you accept?" annoyances soon, this "Not Secure" kinda reminds me of that. It's political, not technical.
Nope. "Naive hashing" versus "actual crypto" is indeed technical, not political. There are at least three different ways in which your "secure" password field is actually insecure (and thus deserves the label "not secure").
Yes, but security is always in a context. I will not use this login for stuff that requires security, like my bitcoin bank for example, there I will use the same idea (hashing) but with a secret stored and encrypted on the clients machine. Always build what you need when you need it! Also HTTPS is really insecure when you have a root cert like all governements/big companies have.
There's a pretty wide gap between "no security" and "government-adversary security". Most attacks happen on the lower levels of sophistication, a.k.a. by script kiddies. HTTPS fixes that pretty efficiently. Also, big companies have root certs - but trusted outside their perimeter? I think not.
Edit: Also, you won't, but what about other users? The label was there to warn them "this is not secure, be aware of it". You took that away Because It Looks Ugly (I still don't see another reason for that) and make the browser pretend that it's not insecure.
It's not more insecure than it has been for the past 20 years. Actually it's more secure and the script kiddies can only hack it if your password is in their dictionary.
I'm not concerned with script kiddies, I'm concerned with google and co + governments. In that context this is actually more secure. Yes, large companies and governments have root certs that are in your browser right now.
Basically, the scriptkiddies also need MITM, which the ISPs/Governments have by definition. I'm taking my chances with my own crypto, we'll see how that goes. I really dislike the edit horizon of HN, it's like you're not allowed to change opinion.
Also it's not "naive" hashing, I'm using a random salt for each session.
9 comments
[ 4.2 ms ] story [ 34.1 ms ] threadIn other words, it's not enough to capture the keydown event. They have broken native browser functionality and made it less secure - for negligible gain. (That's not to speak of the free, simple and secure HTTPS solution available, ahem LetsEncrypt ahem)
Having a governmental/"big company" hackable security solution wasting many gigawatts and countless hours (ahem LetsEncrypt ahem) is sad.
Instead build your own security IF and WHEN you need it.
But you can keep encrypting those un-cacheable images if you want, and good luck debugging that HTTPS stream!
The same goes for HTTP/2 (only moves head-of-line issue to the TCP layer) and WebSockets (completely over-engineered solution to an already solved problem, see comet-stream).
Countless hours? Took me all of 15 minutes. Debugging HTTPS? Fiddler.
Edit: Also, you won't, but what about other users? The label was there to warn them "this is not secure, be aware of it". You took that away Because It Looks Ugly (I still don't see another reason for that) and make the browser pretend that it's not insecure.
I'm not concerned with script kiddies, I'm concerned with google and co + governments. In that context this is actually more secure. Yes, large companies and governments have root certs that are in your browser right now.
Also it's not "naive" hashing, I'm using a random salt for each session.