| |||||||||||||
Should web developers say no to cookie-based authentication?Should web developers say no to cookie-based authentication?Posted Apr 2, 2010 16:09 UTC (Fri) by ghamlin (guest, #57789)In reply to: Should web developers say no to cookie-based authentication? by eduperez Parent article: Should web developers say no to cookie-based authentication?
No, we've all got to deal with them. We mostly all cave.
That is the mistake. Form-based login screens should never have become acceptable. There can be never be a trusted UI, if the password UI is a webpage (even with flash disabled, even with content restriction ).
It is just broken. It is a good paper and a very pragamtic one,too. He outline many half-way approaches one could take.
In a related vein. I think the ECP profile for SAML would be interesting in the browser. I'd like to see that happen. When it does I hope they build in a trusted visual path element.
Security needs to be outside of javascript and html, otherwise we can't fix it. Cookies are not sane for login credentials.
(Log in to post comments)
|
|||||||||||||