Hacker News Reader

I think for almost all cases, there are simpler solutions:

* Use secure cookies (set the secure bit so these cookies are only sent over HTTPS) for authenticating on your HTTPS site

* Use a separate domain for embeds ("youtube-widgets.com" instead of "youtube.com" on third-party sites)

View on HN

youtube-widgets.com still may, depending on product requirements, need to have some notion of your Youtube account credentials. This would, in turn, potentially make youtube-widgets.com into a back door into your Gmail if somebody wasn't careful. (grumble grumble The decision to merge the Youtube and all-powerful-Google* logins was about my least favorite login decision since OpenID $INSERT_HYPERBOLIC_SOUNDING_REFERENCES_TO_BAD_MYTHICAL_EVENTS_ WHICH_WHILE_BAD_ARE_STILL_NOT_AS_BAD_AS_OPENID.

The simplest solution of all is probably to use HTTPS for _ALL_ connections, whether to widgets or to your site. The cost (in encryption overhead) is trivial* and the value is never having to worry about things like this.

* - unless it prevents you from using a CDN to distribute images and other static-but-large content. Which it shouldn't, if you do it right.

Reply on news.ycombinator.com