changed input type for password fields from 'text' to 'password' #128
Conversation
|
I'm not sure I want to do this (yet). With this change Firefox will complain that sending a password is not secure because https is not being used. This is correct, but I will get emails and forum posts asking what has changed. And I don't really want the extra support burden at this point. I have to answer too many emails each morning as it is. The real issue is that admin connections should probably upgrade to https. But I have never understood how the whole certificate mechanism works and whether it can be done at a low cost for small companies like us who cannot afford to spend thousands of dollars per year on certificate registration (my knowledge about this is likely very out-of-date). |
|
We can talk about the self signed certificates via email or so, nobody is going to spend a cent for that :-) The warning is ok. Accept it as it is -> But, showing the Kiwi at a conference on a beamer, or even on road.... I'd say it is enough that the password is not encrypted on the wire but you should not also present it on the screen.... |
|
Yes, I agree. Please email me directly at [email protected] to discuss. And please excuse my lack of knowledge about security best practices. I am learning about a lot of these topics for the very first time with this project and of course I'm always in a huge hurry to get things done. Things like quality and security unfortunately suffer as a result. I also thought it would be good to include the typical checkbox that says "show password" for those folks (like me, lol) who have trouble typing blind sometimes. |
|
Aehm, Sorry Sir, but this is a Security Issue not an enhancement. We can discuss about Letsencrypt integration, this would be a enhancement. |
|
Well sure, I'm happy to make a new label called "security" instead of reusing the enhancement label if that would make you happy. The only reason this hasn't been changed yet is because you will get a nasty message from the browser (Firefox at least) saying a form submit with type=password over a non-https connection is insecure (which it is!) But there are some complications here. The submit isn't directly going over the wire as http. It's going to javascript via an onsubmit=. So the type=password is really just a way to get opaque character entry in the input field. But to use it the entire Kiwi connection would have to be https. And that means the pain of dealing with certs etc. I have never done any of that and there would be a learning curve. There are easier ways to get opaque entry. Sure, the https problem needs to be solved eventually. But if you're doing that then there is also the question of data sent on the web sockets. Using secure web sockets has big performance implications. |
No description provided.