[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Particip a

• To: Rich Salz <rsalz@d...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• From: Elliotte Rusty Harold <elharo@m...>
• Date: Tue, 6 Jan 2004 12:51:19 -0500
• Cc: XML-DEV <xml-dev@l...>
• In-reply-to: <3FFAF0D5.60805@d...>
• References: <Pine.LNX.4.44L0.0401052326150.4127-100000@s...><p06010203bc2071a8d656@[192.168.254.4]> <3FFAE7EF.9060702@d...><p0601020cbc20974faee7@[192.168.254.4]> <3FFAF0D5.60805@d...>

At 12:31 PM -0500 1/6/04, Rich Salz wrote:

>If you use it more than once, it's not a login password, it's a 
>session key.  Having session keys be passwords that are created by 
>users is ridiculously bad security practice.  Digest-auth is subject 
>to dictionary attacks.  Encrypting data in the server's public key 
>brings scalability issues (imagine SSL without any caching!).
>
>Good security requires state, and that seems to be counter to REST.

For the cases where this is really an issue, then maybe it is time to 
look at SSL and https so you're using real session keys. Yes, it 
costs CPU; but CPUs are cheaper and faster every day. And not all 
applications or pages need this level of security. Use it where you 
need it.
-- 

   Elliotte Rusty Harold
   elharo@m...
   Effective XML (Addison-Wesley, 2003)
   http://www.cafeconleche.org/books/effectivexml
   http://www.amazon.com/exec/obidos/ISBN%3D0321150406/ref%3Dnosim/cafeaulaitA

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Rich Salz <rsalz@d...>

• References:
  • RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Rich Salz <rsalz@d...>
  • RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Rich Salz <rsalz@d...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Rich Salz <rsalz@d...>

• Prev by Date: RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Index(es):
  • Date
  • Thread