W3C home > Mailing lists > Public > public-webappsec@w3.org > December 2014

Re: [blink-dev] Re: Proposal: Marking HTTP As Non-Secure

From: Craig Francis <craig.francis@gmail.com>
Date: Fri, 26 Dec 2014 22:38:48 +0000
Cc: "mozilla-dev-security@lists.mozilla.org" <mozilla-dev-security@lists.mozilla.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, security-dev <security-dev@chromium.org>, blink-dev <blink-dev@chromium.org>
Message-Id: <F5ACB7F4-B569-40C2-8C28-0CEBB94E4830@gmail.com>
To: Jiri Danek <softwaredevjirka@gmail.com>

> On 26 Dec 2014, at 22:20, Jiri Danek <softwaredevjirka@gmail.com> wrote:
> Have there been any suggestions what to do about <FORM>s sent over HTTP that include <INPUT type="password">? For example marking the password field itself as dubious/insecure? (I am absolutely not saying that is what browsers should be doing, mind you)

Oh, just set the form action to an invalid HTTPS url, and change it with JS on the submit event, or just send via AJAX... see perfectly secure (no warnings), you can even use rot-13 for extra protection... and who cares about non JS browsers? :-P

Seriously though, we need to start moving over to HTTPS only... baby steps at first (e.g. tiny UI hints to educate users), fix the issues (e.g. issuing and installing certs), but we can get there eventually :-)

Received on Friday, 26 December 2014 22:39:16 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:08 UTC