Absolutely. In fact, if part of a solution to any problem is to get all parties on SSL, then nonces can just go away -- am I right?<div><br clear="all">--<br>Andrew Arnott<br>"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre<br>
<br><br><div class="gmail_quote">On Wed, Jan 27, 2010 at 4:38 PM, Breno de Medeiros <span dir="ltr"><<a href="mailto:breno@google.com">breno@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">> And I'm not trying to be a nit-picky HTTP purist here. I'm talking about<br>
> real-world problems from browsers, plugins, and/or proxies that believe GETs<br>
> are actually side-effect free, that are causing logins to fail.<br>
<br>
</div>Yep, unfortunately the user experience in POST requests is suboptimal,<br>
so nobody is excited to move this direction.<br>
<br>
If the lack of effect-freeness is being manifested mostly in nonce<br>
verification failures, then we could have a discussion around that<br>
that might lead us somewhere.<br>
</blockquote></div><br></div>