How to work around chrome “Not Secure” with HTTP login

by bullen • 9 years ago

1 9 9 years ago

Piskvorrr4• 9 years ago

The authors haven't read this, have they? https://news.ycombinator.com/item?id=13456706

In other words, it's not enough to capture the keydown event. They have broken native browser functionality and made it less secure - for negligible gain. (That's not to speak of the free, simple and secure HTTPS solution available, ahem LetsEncrypt ahem)

bullen5• 9 years ago

This actually hashes the password with a salt which atleast avoids sending the password in clear text.

Having a governmental/"big company" hackable security solution wasting many gigawatts and countless hours (ahem LetsEncrypt ahem) is sad.

Instead build your own security IF and WHEN you need it.

But you can keep encrypting those un-cacheable images if you want, and good luck debugging that HTTPS stream!

The same goes for HTTP/2 (only moves head-of-line issue to the TCP layer) and WebSockets (completely over-engineered solution to an already solved problem, see comet-stream).

Piskvorrr4• 9 years ago

Main issue is with UX - password manager integration? Nope. Pasting? Nope. Avoiding a warning "insecure form" on an insecure form? Well yeah. Here, have a cookie.

Countless hours? Took me all of 15 minutes. Debugging HTTPS? Fiddler.

How to work around chrome “Not Secure” with HTTP login

Related Stories