Reputation
Next privilege 125 Rep.
Vote down
Badges
2
Newest
 Supporter
Impact
0 people reached

  • 0 posts edited
  • 0 helpful flags
  • 7 votes cast
Feb
11
comment Demystifying Web Authentication (Stateless Session Cookies)
Ugh, looks terrible! I'm very sorry, but what's the problem with storing the authentication state server-side and just having a session ID client side? Using SSL, and a HTTPS-only session cookie - where or what's the issue? Any solution where anything from the client is trusted, feels bad.
Jan
29
comment From a security standpoint should users be asked to confirm their password when registering?
I personally think the UX trend towards a single field is wrong. In the sense that no user will care if you ask them to repeat their password. This is a one-time activity for most users, if they want an account, they'll play along. They're not going to throw a furious tantrum and leave, just because of that. The UX guys are saying these days resetting a password is a trivial matter. No matter how you look at it, resetting your password is a whole lot more pain than just repeating it the once when you create/change it.
Jan
29
awarded  Supporter
Jan
29
awarded  Autobiographer