Re: [apps-discuss] [http-auth] [saag] [websec] [kitten] HTTP authentication: the next generation

[der Mouse <[e-mail]>]

> You've never signed up for a new account from a hotel or a public
> wifi?

I don't think so.  Most certainly not for an account of nontrivial
value (see below) without something at least as strong as ssh securing
the channel from a computer I trust (which is a subset of computers I
own and administer).

>> For all that that's rhetorical, there is an answer: because [initial
>> signup] occurs only once while [login] occurs many times.
> I bet for a lot of systems, people sign up once and try it out then
> go away and leave their accounts dormant.

You quite likely are right.  But in that case the account clearly is of
little value to the holder, so I have trouble getting too worried. :)

> Even still, how do you convince a web designer that they must give up
> their HTML login form for security when they have an HTML login form
> to choose the password in the first place?

Personally, I don't.  I mostly don't bother with Web stuff at all - you
may note that what I've said here is almost entirely non-Web-specific -
and _never_ do anything involving signups or the like "online"
(meaning, on the Web; I have done such things unsecured over the
Internet, such as creating a login on nethack.alt.org or creating
characters on muds - these are examples of accounts of trivial value).

But if someone were to argue that way with me, I'd basically just shrug
and let it go as "I pointed out the issues; if you want to ignore them
you may be right or you may get burned, and, if the latter, I feel no
responsibility for it".

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[e-mail]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B