101 reputation
bio website webdeavour.co.uk
location Stoke-on-Trent, United Kingdom
age 39
visits member for 2 years, 6 months
seen May 12 at 9:20
UK Government Website Developer. Member of W3C HTML Working Group.

comment Demystifying Web Authentication (Stateless Session Cookies)
Ugh, looks terrible! I'm very sorry, but what's the problem with storing the authentication state server-side and just having a session ID client side? Using SSL, and a HTTPS-only session cookie - where or what's the issue? Any solution where anything from the client is trusted, feels bad.
comment From a security standpoint should users be asked to confirm their password when registering?
I personally think the UX trend towards a single field is wrong. In the sense that no user will care if you ask them to repeat their password. This is a one-time activity for most users, if they want an account, they'll play along. They're not going to throw a furious tantrum and leave, just because of that. The UX guys are saying these days resetting a password is a trivial matter. No matter how you look at it, resetting your password is a whole lot more pain than just repeating it the once when you create/change it.
awarded  Supporter
awarded  Autobiographer