- From: Craig Francis <craig.francis@gmail.com>
- Date: Fri, 26 Dec 2014 22:38:48 +0000
- To: Jiri Danek <softwaredevjirka@gmail.com>
- Cc: "mozilla-dev-security@lists.mozilla.org" <mozilla-dev-security@lists.mozilla.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, security-dev <security-dev@chromium.org>, blink-dev <blink-dev@chromium.org>
> On 26 Dec 2014, at 22:20, Jiri Danek <softwaredevjirka@gmail.com> wrote: > > Have there been any suggestions what to do about <FORM>s sent over HTTP that include <INPUT type="password">? For example marking the password field itself as dubious/insecure? (I am absolutely not saying that is what browsers should be doing, mind you) Oh, just set the form action to an invalid HTTPS url, and change it with JS on the submit event, or just send via AJAX... see perfectly secure (no warnings), you can even use rot-13 for extra protection... and who cares about non JS browsers? :-P Seriously though, we need to start moving over to HTTPS only... baby steps at first (e.g. tiny UI hints to educate users), fix the issues (e.g. issuing and installing certs), but we can get there eventually :-) Craig
Received on Friday, 26 December 2014 22:39:16 UTC