News for hackers. Stuff that matters.

A comment on Using HTTP Basic Auth in 2022. Parent comment

Re:Using HTTP Basic Auth in 2022 by thesz on Sunday January 02, 2022 @04:22AM (#29767174)
This is what was done in the EROS [1] (extremely reliable operating system) UIs - it was not possible for user window to be rendered completely undistinguishable from system windows like, you knew it, a password prompt.

[1] https://en.wikipedia.org/wiki/EROS_(microkernel)

EROS used capabilities to enforce such rules. If you lack a capability to be a system window, you can't pretend to be one.

[ Parent | on HN ]
Re:Using HTTP Basic Auth in 2022 by amluto on Sunday January 02, 2022 @01:24PM (#29771800)
This is also what a secure attention key is for. Sadly the well known implementation (Windows NT) made it sufficiently obnoxious that it went away.

I can imagine keyboards having a special “password” key and trying to train people that all passwords start with the password key. I don’t know if this would work, but it can’t be worse than Ctrl-alt-delete.

[ Parent | on HN ]