Saving the credentials by browser on login page

Jiri Kremser jkremser at redhat.com
Thu Aug 30 16:37:12 UTC 2012


Well, speaking of security, I don't thing sending the credentials over the http in plaintext/base64 is secure either, but we don't prevent users doing it. I know they can deploy the RHQ and set the security with AS over SSL, but the bundled AS doesn't do that (correct me if I am wrong).

I am not advocating storing the password in a plain text on the client side, I just want to get rid of annoying login page or at least shorten the login process. My fingers got used to, but still, it is annoying :]

Storing just username to the user cookie can be a good enough solution without any risks, imo. Codemonkey script could be a good way to go as well, just for us developers type in rhqadmin:rhqadmin by a JS script.

btw. Why all people using linux are paranoid? :]
JK



----- Original Message -----
From: "John Mazzitelli" <mazz at redhat.com>
To: rhq-devel at lists.fedorahosted.org
Sent: Thursday, August 30, 2012 6:16:55 PM
Subject: Re: Saving the credentials by browser on login page

IMO, I would recommend staying far away from doing anything "for convenience" that has anything to do with security. This is asking for trouble.

It is best if something like "my password was hacked" can be 100% blamed on, say, the browser or a weak password (as opposed to it being blamed on RHQ :-)

Seriously, the minute you start attempting to implement something around security like this, you WILL get people looking very closely at your code and dollars to donuts, some hole some where will be found (which I can attest to with the "convenience" feature we had for the agent token stuff a while ago that we ended up removing).

As the guy on that old TV cop show used to say, "Let's be careful out there!"

P.S. Your fingers learn to type "rhqadmin" really fast after you do it for a while. :)

----- Original Message -----
> 
> IMO storing the password is a poor choice (even if done properly) and
> may not be welcomed as a feature by some organizations. However,
> storing the user name might be nice but even that should not be in
> plain text. Here is another link to complement the link below:
> http://crackstation.net/hashing-security.htm
> 
> 
> Obviously this is a sensitive area.
> 
> 
> 
> HTML5 local storage is another option to cookies. Cookies get sent
> with every request including images and gwt-rpc. This way the
> username would never leave the client (except for the actual login).
> FF and IE9 have support for it and there is a polyfill for web
> storage in IE8.
> 
> 
> 
> 
> 
> 
> 
> 
> On Aug 30, 2012, at 7:36 AM, Jiri Kremser < jkremser at redhat.com >
> wrote:
> 
> 
> Hi,
> I've found this page [1] and I am trying to get this idea working.
> Lukas suggested the values can be obtained from the hidden form by
> JS (DOM manipulation). But there will be probably necessary to do
> the other way i.e. to fill the form and submit it with some kind of
> no-op somehow on the background to let the browser to store it.
> Other option could be to use the cookies
> com.google.gwt.user.client.Cookies.{get|set}Value() but I am not
> sure about storing the password in plaintext somewhere in the cookie
> without asking the user.
> 
> Browser does basically the same, but at least it asks :]
> Yes, but this is not secure either.
> 
> 
> 
> 
> 
> [1]
> http://code.google.com/p/google-web-toolkit-incubator/wiki/LoginSecurityFAQ#auto-complete_and_GWT
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
_______________________________________________
rhq-devel mailing list
rhq-devel at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/rhq-devel


More information about the rhq-devel mailing list