News for hackers. Stuff that matters.

A comment on Ebay posts every character a user types into the password box. Parent comment

Re:Ebay posts every character a user types into the password... by userbinator on Wednesday June 29, 2016 @08:23AM (#12001170)
Are you implying that POST data isn't going to be transmitted in cleartext beyond that point? Because that's incorrect - HTTPS doesn't selectively encrypt - the whole connection is encrypted. If you're worried about GET data being sent in cleartext, POST is no different.
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by dudus on Wednesday June 29, 2016 @09:26AM (#12001474)
The point is that GET parameters are more likely to be stored in server logs or other application logs where POST body is usually discarded from such logs.

So someone getting access to the logs will have access to a lot of possibly sensitive data, that's all depending on server and application settings, but by default GET are more likely to leave traces than POST.

It's a subtle but valid concern.

[ Parent | on HN ]