Re: MS to stop allowing passwords in URLs
On Mon, 2 Feb 2004 21:01:45 -0700
"Dave Warren" <dave.warren@xxxxxxxxxxxxxxxxxxxx> wrote:
> The safety concerns of http://user:pass@www aren't technical, they're
> user/training issues.. How do you explain to your grandmother that
> http://www.herbank.com:login.asp@xxxxxxxxxxxxxxxx/ isn't safe but
> http://www.herbank.com/login.asp?arhuz.ru/ is okay?
>
> The solution, in my opinion, would be to come up with a new notation that
> doesn't break existing RFCs, but that still places the hostname first.
Or, hey, a different on-screen representation? Something like, I dunno,
"http://user:pass@site/"; being turned into "http://site/ (user: user,
password: pass)"?
If you're worried about anything *other* than either the URL bar or the
status bar (like, for instance, the descriptive text of the link),
you're out of luck anyways. People who would still fall for that will
also fall for <a
href="http://www.please-crack-me.ru";>http://www.microsoft.com</a>
Seriously, KISS. ("Keep It Simple, Stupid" for those who either aren't
familiar with the jargon or aren't native English speakers ;)