<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
See below:<br>
<br>
Dick Hardt wrote:
<blockquote cite="mid342AE58F-10E8-476D-A52F-BD539ED925AF@sxip.com"
type="cite">
<pre wrap="">On 23-Oct-06, at 4:47 AM, James A. Donald wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Dick Hardt wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Perhaps we can discuss this from another point of
view. Why should I need SSL on a blog I am writing a
comment on when all the data I provide the blog will
be published and public anyway? An attacker is not
going to see anything more on the HTTP connection then
they would on the blog?
</pre>
</blockquote>
<pre wrap="">If he sees your users login information, there is a
problem.
</pre>
</blockquote>
<pre wrap=""><!---->
Not if he is seeing the results. Obviously if the attacker sees the
users username and password there is a problem.
</pre>
</blockquote>
And even more obvious, a homesite would give you options to change the
password and/or personal details...Other sites might have other details
to show in the "personal user area". And yes, there is a huge problem!<br>
<br>
BTW, with today's spam on forums, which includes URL postings and
sending mail messages to members, this even is already a problem at
this low-profile sites...<br>
<br>
Therefore: Bad design will always hurt and insecurity by design even
more...It doesn't matter, if the login is a blog or payment site, both
have the right and interest on reasonable protection, otherwise it
simply will not stick....<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>