Saving the credentials by browser on login page

John Mazzitelli mazz at redhat.com
Thu Aug 30 16:16:55 UTC 2012


IMO, I would recommend staying far away from doing anything "for convenience" that has anything to do with security. This is asking for trouble.

It is best if something like "my password was hacked" can be 100% blamed on, say, the browser or a weak password (as opposed to it being blamed on RHQ :-)

Seriously, the minute you start attempting to implement something around security like this, you WILL get people looking very closely at your code and dollars to donuts, some hole some where will be found (which I can attest to with the "convenience" feature we had for the agent token stuff a while ago that we ended up removing).

As the guy on that old TV cop show used to say, "Let's be careful out there!"

P.S. Your fingers learn to type "rhqadmin" really fast after you do it for a while. :)

----- Original Message -----
> 
> IMO storing the password is a poor choice (even if done properly) and
> may not be welcomed as a feature by some organizations. However,
> storing the user name might be nice but even that should not be in
> plain text. Here is another link to complement the link below:
> http://crackstation.net/hashing-security.htm
> 
> 
> Obviously this is a sensitive area.
> 
> 
> 
> HTML5 local storage is another option to cookies. Cookies get sent
> with every request including images and gwt-rpc. This way the
> username would never leave the client (except for the actual login).
> FF and IE9 have support for it and there is a polyfill for web
> storage in IE8.
> 
> 
> 
> 
> 
> 
> 
> 
> On Aug 30, 2012, at 7:36 AM, Jiri Kremser < jkremser at redhat.com >
> wrote:
> 
> 
> Hi,
> I've found this page [1] and I am trying to get this idea working.
> Lukas suggested the values can be obtained from the hidden form by
> JS (DOM manipulation). But there will be probably necessary to do
> the other way i.e. to fill the form and submit it with some kind of
> no-op somehow on the background to let the browser to store it.
> Other option could be to use the cookies
> com.google.gwt.user.client.Cookies.{get|set}Value() but I am not
> sure about storing the password in plaintext somewhere in the cookie
> without asking the user.
> 
> Browser does basically the same, but at least it asks :]
> Yes, but this is not secure either.
> 
> 
> 
> 
> 
> [1]
> http://code.google.com/p/google-web-toolkit-incubator/wiki/LoginSecurityFAQ#auto-complete_and_GWT
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 


More information about the rhq-devel mailing list