Saving the credentials by browser on login page

Lukas Krejci lkrejci at redhat.com
Fri Aug 31 06:45:30 UTC 2012


Well, this whole thing is not about us implementing some convenience for the users but about us NOT PREVENTING a convenience function that browsers implement.

I see a big difference there. It is a standard feature of all browsers to offer to "save passwords" on any page where people put in credentials. This is not possible on RHQ login page. It is not for us to answer the security aspects of this solution or to try to be "smarter" than the browsers are.

For me this is a rather big usability issue.

Lukas

----- Original Message -----
> From: "John Mazzitelli" <mazz at redhat.com>
> To: rhq-devel at lists.fedorahosted.org
> Sent: Thursday, August 30, 2012 6:16:55 PM
> Subject: Re: Saving the credentials by browser on login page
> 
> IMO, I would recommend staying far away from doing anything "for
> convenience" that has anything to do with security. This is asking
> for trouble.
> 
> It is best if something like "my password was hacked" can be 100%
> blamed on, say, the browser or a weak password (as opposed to it
> being blamed on RHQ :-)
> 
> Seriously, the minute you start attempting to implement something
> around security like this, you WILL get people looking very closely
> at your code and dollars to donuts, some hole some where will be
> found (which I can attest to with the "convenience" feature we had
> for the agent token stuff a while ago that we ended up removing).
> 
> As the guy on that old TV cop show used to say, "Let's be careful out
> there!"
> 
> P.S. Your fingers learn to type "rhqadmin" really fast after you do
> it for a while. :)
> 
> ----- Original Message -----
> > 
> > IMO storing the password is a poor choice (even if done properly)
> > and
> > may not be welcomed as a feature by some organizations. However,
> > storing the user name might be nice but even that should not be in
> > plain text. Here is another link to complement the link below:
> > http://crackstation.net/hashing-security.htm
> > 
> > 
> > Obviously this is a sensitive area.
> > 
> > 
> > 
> > HTML5 local storage is another option to cookies. Cookies get sent
> > with every request including images and gwt-rpc. This way the
> > username would never leave the client (except for the actual
> > login).
> > FF and IE9 have support for it and there is a polyfill for web
> > storage in IE8.
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > On Aug 30, 2012, at 7:36 AM, Jiri Kremser < jkremser at redhat.com >
> > wrote:
> > 
> > 
> > Hi,
> > I've found this page [1] and I am trying to get this idea working.
> > Lukas suggested the values can be obtained from the hidden form by
> > JS (DOM manipulation). But there will be probably necessary to do
> > the other way i.e. to fill the form and submit it with some kind of
> > no-op somehow on the background to let the browser to store it.
> > Other option could be to use the cookies
> > com.google.gwt.user.client.Cookies.{get|set}Value() but I am not
> > sure about storing the password in plaintext somewhere in the
> > cookie
> > without asking the user.
> > 
> > Browser does basically the same, but at least it asks :]
> > Yes, but this is not secure either.
> > 
> > 
> > 
> > 
> > 
> > [1]
> > http://code.google.com/p/google-web-toolkit-incubator/wiki/LoginSecurityFAQ#auto-complete_and_GWT
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> > 
> > 
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> > 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 


More information about the rhq-devel mailing list