News for hackers. Stuff that matters.

A comment on Twitter urges users to change passwords after computer 'glitch'. Parent comment

Re:Twitter urges users to change passwords after computer 'g... by jchw on Thursday May 03, 2018 @07:32PM (#16990945)
I believe you could use a construction like HMAC to make it so that during authentication (not password setting events) you don't actually send the token. But if someone is already able to MITM your requests, what are the odds they can't just poison the JavaScript to send it in plaintext back to them?
[ Parent | on HN ]
Re:Twitter urges users to change passwords after computer 'g... by tripletao on Thursday May 03, 2018 @08:38PM (#16991276)
I think their goal is to still use https, but stop anything important from leaking if a sloppy server-side developer logs the full requests after TLS decryption (as Twitter did here).
[ Parent | on HN ]