Re: [PHPLIB] the challenge response authentication - is it really moresecure? From: Mike Hobson (mhobson <email protected>)
Date: 11/10/99

Dear All,

According to my copy of IDG's "Javascript Bible" 3rd Edition,
password fields work exactly like text fields beginning
with Netscape Version 3. The password INPUT value can be
cleared after the MD5 is calculated and before the MD5
authorization is sent.

Best Regards,

Michael A. Hobson

Kristian Köhntopp wrote:
>
> Chuck Hagenbuch wrote:
> > the password gets sent back as well. The specs for an <input
> > type="password"> (according to my O'Reilly Javascript 2nd edition book)
> > pretty clearly state that the value field of a Password element is read-only
> > - meaning not only that you can't read the value, but that you can't clear
> > it either, as challenge-response auth tries to do.
>
> Sorry, but this is about the most braindead specification I have
> ever heard. Not being able to READ the password would make sense
> in an attempt to keep the password secret and would break PHPLIBs
> Challenge-Response security completely. Not being able to clear,
> i.e. WRITE, a password is about as useless as it can get.
>
> Having protected password fields and NOT providing "star-display"
> fields which are not protected at the same time is - well - kind
> of half assed. And of course protected password fields should stand
> out visually so that they can be recognized and distinguished from
> star-display fields by the user.
>
> Kristian
>
> --
> Kristian Köhntopp, NetUSE Kommunikationstechnologie GmbH
> Siemenswall, D-24107 Kiel, Germany, +49 431 386 436 00
> Using PHP3? See our web development library at
> http://phplib.netuse.de/ (We have moved! Update your bookmarks!)
> -
> PHP3 Base Library Mailing List. Send messages to <phplib <email protected>>.
> To unsubscribe, send "unsubscribe" to <phplib-request <email protected>> in
> the body, not the subject, of your message.
-
PHP3 Base Library Mailing List. Send messages to <phplib <email protected>>.
To unsubscribe, send "unsubscribe" to <phplib-request <email protected>> in
the body, not the subject, of your message.