Hacker News Reader

Comment by rmc | Hacker News Reader

Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?

Won't work. People have too many accounts to be able to remember unique passwords. A large percentage of mundane users won't understand these things and will just be nagged all the time that they cannot log into their accounts with this new Firething.

View on HN

We could warn "this is the same as site X which is HTTP". If it's a throw away, that is fine. If it's not, that might matter.

When you enter your password into an input on a page served over HTTP, it is already game over.

Not if you use a throwaway, crappy password, that you do not care gets compromised.

Your proposal, as it stands, doesn't warn the user until /after/ they've typed a non-throwaway password into a site served over http.

You'd need to warn them before they even start typing a password in on an http page.

Ideally yes, but almost no sites send passwords as they are typed. The only likely situation where that would be a problem is if the site itself is compromised, in which case nothing can save you.

Not just a site compromise; a path compromise (malicious exit node, shady ISP, or fake WiFi access point) can inject Javascript in an unencrypted page. CA-signed SSL with cert pinning prevents MITM injection.

You could do that. As you type into any <input type="password"> the browser would buffer the text and not send it through to the DOM immediately. When you hit enter, leave the field, submit the form, etc then it'd get sent through to the DOM where it'd be available to (potentially malicious) javascript. While the password is in the buffer the browser could check for "non-throwaway password + http" and block it if need be.

This does require the browser to know which passwords are which, though, at which point it might as well be entering them for you (and only being willing to do that over https).

What percentage of internet users do you think know what "HTTP" means?

Good point. I would guess 40%.

Really? I would guess substantially less than 1%.

Google did some videos asking the general public what browser they use (before they released Chrome). It might be informative for you.

Then force unique passwords without requiring the users to remember them, something which is both easier for users and more secure.

Reply on news.ycombinator.com