OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   Re: [xml-dev] Re: Cookies at XML Europe 2004 -- Call for Particip a

[ Lists Home | Date Index | Thread Index ]

At 12:31 PM -0500 1/6/04, Rich Salz wrote:

>If you use it more than once, it's not a login password, it's a 
>session key.  Having session keys be passwords that are created by 
>users is ridiculously bad security practice.  Digest-auth is subject 
>to dictionary attacks.  Encrypting data in the server's public key 
>brings scalability issues (imagine SSL without any caching!).
>Good security requires state, and that seems to be counter to REST.

For the cases where this is really an issue, then maybe it is time to 
look at SSL and https so you're using real session keys. Yes, it 
costs CPU; but CPUs are cheaper and faster every day. And not all 
applications or pages need this level of security. Use it where you 
need it.

   Elliotte Rusty Harold
   Effective XML (Addison-Wesley, 2003)


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS