Cart
[Home] [By Thread] [By Date] [Recent Entries]
At 12:31 PM -0500 1/6/04, Rich Salz wrote: >If you use it more than once, it's not a login password, it's a >session key. Having session keys be passwords that are created by >users is ridiculously bad security practice. Digest-auth is subject >to dictionary attacks. Encrypting data in the server's public key >brings scalability issues (imagine SSL without any caching!). > >Good security requires state, and that seems to be counter to REST. For the cases where this is really an issue, then maybe it is time to look at SSL and https so you're using real session keys. Yes, it costs CPU; but CPUs are cheaper and faster every day. And not all applications or pages need this level of security. Use it where you need it. -- Elliotte Rusty Harold elharo@m... Effective XML (Addison-Wesley, 2003) http://www.cafeconleche.org/books/effectivexml http://www.amazon.com/exec/obidos/ISBN%3D0321150406/ref%3Dnosim/cafeaulaitA
|
