Recent Features
| |||||||||||||
Should web developers say no to cookie-based authentication?Should web developers say no to cookie-based authentication?Posted Apr 1, 2010 6:42 UTC (Thu) by eduperez (guest, #11232)Parent article: Should web developers say no to cookie-based authentication?
I guess this man has never had to deal with a marketing department... just try to explain to them why their visitors will see an ugly dialog instead of a fancy web page.
(Log in to post comments)
Should web developers say no to cookie-based authentication? Posted Apr 2, 2010 16:09 UTC (Fri) by ghamlin (guest, #57789) [Link]
No, we've all got to deal with them. We mostly all cave.
That is the mistake. Form-based login screens should never have become acceptable. There can be never be a trusted UI, if the password UI is a webpage (even with flash disabled, even with content restriction ).
It is just broken. It is a good paper and a very pragamtic one,too. He outline many half-way approaches one could take.
In a related vein. I think the ECP profile for SAML would be interesting in the browser. I'd like to see that happen. When it does I hope they build in a trusted visual path element.
Security needs to be outside of javascript and html, otherwise we can't fix it. Cookies are not sane for login credentials.
|
|||||||||||||