Chrome 56 will mark HTTP pages with password fields as non-secure

Re:Chrome 56 will mark HTTP pages with password fields as no... by jayd16 on Monday January 23, 2017 @02:17AM (#13460460)

Besides issues like requiring javascript or something, its usually not a useful step. The hash of the password can be stolen just as easily as the password itself. You've just made a new password.

If you salt the password with the url, all you've done is made a unique password per website which is what you were supposed to be doing anyway.

[ Parent | on HN ]

Re:Chrome 56 will mark HTTP pages with password fields as no... by dsp1234 on Monday January 23, 2017 @11:07AM (#13463109)

The point was for the browser to warn the end user about password re-use.

The browser doesn't need javascript to see the contents of a password field, or to show an indicator in the browser's chrome. It's the browser.

If you salt the password with the url, all you've done is made a unique password per website which is what you were supposed to be doing anyway.

Note that browsers can already store password lists (ex: Chrome settings, search manage passwords). There would just be an extra step to compare those passwords together.

[ Parent | on HN ]