Saving the credentials by browser on login page

mike thompson mithomps at redhat.com
Thu Aug 30 16:05:48 UTC 2012


IMO storing the password is a poor choice (even if done properly) and may not be welcomed as a feature by some organizations. However, storing the user name might be nice but even that should not be in plain text. Here is another link to complement the link below: http://crackstation.net/hashing-security.htm

Obviously this is a sensitive area.

HTML5 local storage is another option to cookies. Cookies get sent with every request including images and gwt-rpc. This way the username would never leave the client (except for the actual login).  FF and IE9 have support for it and there is a polyfill for web storage in IE8.



On Aug 30, 2012, at 7:36 AM, Jiri Kremser <jkremser at redhat.com> wrote:

> Hi,
> I've found this page [1] and I am trying to get this idea working. Lukas suggested the values can be obtained from the hidden form by JS (DOM manipulation). But there will be probably necessary to do the other way i.e. to fill the form and submit it with some kind of no-op somehow on the background to let the browser to store it. Other option could be to use the cookies com.google.gwt.user.client.Cookies.{get|set}Value() but I am not sure about storing the password in plaintext somewhere in the cookie without asking the user.
> 
> Browser does basically the same, but at least it asks :]
Yes, but this is not secure either.
> 
> 
> 
> [1] http://code.google.com/p/google-web-toolkit-incubator/wiki/LoginSecurityFAQ#auto-complete_and_GWT
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/rhq-devel/attachments/20120830/36045cd6/attachment-0001.html>


More information about the rhq-devel mailing list