OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

 


 

   Re: [xml-dev] Expertise and Innovation - was Re: [xml-dev] Non-Borgserve

[ Lists Home | Date Index | Thread Index ]
  • To: Rich Salz <rsalz@datapower.com>
  • Subject: Re: [xml-dev] Expertise and Innovation - was Re: [xml-dev] Non-Borgservers can authenticate Borg clients (Was Re: [xml-dev] Re: Cookies atXML Europe 2004 -- Call for Participation)
  • From: Alaric B Snell <alaric@alaric-snell.com>
  • Date: Wed, 04 Feb 2004 14:08:41 +0000
  • Cc: "Simon St.Laurent" <simonstl@simonstl.com>,"'xml-dev@lists.xml.org '" <xml-dev@lists.xml.org>
  • In-reply-to: <Pine.LNX.4.44L0.0401100752020.21696-100000@smtp.datapower.com>
  • References: <Pine.LNX.4.44L0.0401100752020.21696-100000@smtp.datapower.com>
  • User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030704 Debian/1.4-1

Rich Salz wrote:
>>It's tough when Elliotte's that completely right, but it happens pretty
>>regularly.  Usually when I'm on the other side, unfortunately.
> 
> 
> Hey, let's not get carried away.
> 
> Just because digest-auth is more interoperable than we all expected,
> doesn't mean it's the right thing to do.  I still strongly stand by my
> arguments against it and in favor of those old-fogey security mechanisms.

And it's still the case that both users and programmers have less 
control over HTTP auth; browsers still don't give you "logout" buttons 
that uncache the username and password you've entered, the credentials 
have to be submitted with every request rather than just once (widening 
the window of vulnerability to snooping), the server cannot enforce that 
sessions expire after a certain period of inactivity (and sometimes they 
will *need* to mandate that to meet the requirements of banking 
applications and so on, regardless of user browser choices and 
settings), and so on.

ABS





 

News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS