Craig, I would agree with the later perspective you are stating 10 maybe 5 years ago, Craig. But with so many incredibly highly-visible hacking incidents in the last few years, /the culture around developers and users perspective of security is rapidly changing/. You have a chance to be bold at the standard level, possibly even get all of the major browsers to agree to said standard, and be a bit more aggressive in application security education and awareness in the browser. How much can that slider be increased? I'm not sure. But again I really think this one, forcing a password field to be transported encrypted, is such a low bar in terms of increasing security in the browser. So when a developer allows a users credential to be sent plaintext, it's a huge application security crime. _*If the browser lets this happen without any attempt to warn the user or developer, then I call the browser a serious accomplice in this terrible and very basic security crime. *_ - Jim On 1/2/15 9:55 PM, Craig Francis wrote: > > On 2 Jan 2015, at 22:09, Jim Manico <jim.manico@owasp.org > <mailto:jim.manico@owasp.org>> wrote: > >> So I say the browser absolutely knows that the data is - it's data >> that is sent over a field that a developer specifically labeled as a >> password. Passwords /*must*/ be sent over HTTPS or nothing in today's >> threatscape. > > > Hi Jim, > > I really appreciate what you're saying, and I would really like this > as well. > > But think about it from the typical programmers point of view... their > customers/managers might complain that the password field "looks odd" > (the warning approach - where they won't read the error message, > that's too difficult)... or does not work at all. > > That developer might implement HTTPS... but in most cases (because > they don't have time, or possibly too lazy, with a manager saying > "just fix it, and there's no budget for this"), they will just change > the input type to "text"... and possibly copy/paste a jQuery plugin > that will "bring back the dots", e.g. > > http://www.jqueryscript.net/form/iOS-Like-Plain-Text-Input-of-Password-with-jQuery-mobilePassword-Plugin.html > > http://css-tricks.com/better-password-inputs-iphone-style/ > > That's assuming the developer does not say that the browser is broken, > and they should use a different one (I've unfortunately seen this > response a few times before). > > Craig
Received on Saturday, 3 January 2015 08:16:13 UTC