Printable View
Over in questions about AO I've been talking about how I have a problem with signing into AO from computers I don't trust. MsM recommended that I make a suggestion about it...so here it is. :D Would it be feasible for us to have an encrypted/secure login similar to the one hotmail/yahoo uses for email login?
Greetings:
Unfortunately, this couldn't be done without a LOT of modification to the site code. Because of cookies, server sessions and the like, you would have to interact with the site entirely in ssl after you've been logged in. The site is just not designed for that...
There are some changes that I had in the works before I sold the site that could be implemented to help make things a bit more secure though. Such as a user security center, that would let them globally log out all cookies no matter what box they're on, limiting logins to certain IPs or subnets, show a list of all IPs that have accessed the site under their account, etc. etc. Features like that would be very easy to integrate, and much of the data necessary to work them is already (or at least was) collected by the site.
Keezel: Still doesn't stop keyloggers unfortunately..... You have to trust the machine your on before the SSL makes the network you are on trustable......
I've been using AO for over three years now, I think if someone really wanted to sniff my password they would have done so already. ;)
Seriously though, I don't think SSL support for AO is really worth the hassle - it's not as if you're providing sensitive information such as credit card details. I guess we could have a a secure sign in option (so that your username/password wouldn't be transmitted in plaintext - shouldn't be too difficult to implement) but the question you have to ask is whether it provides any benefit and to JM whether it would produce a return on the cost of implementing it.
Not only that, but anyone trying to sniff out anyone's account must on AO must really not have a life. ;)Quote:
I've been using AO for over three years now, I think if someone really wanted to sniff my password they would have done so already.
I recall another request for a "delete all cookies" option, so that's been added, as an alternate logout option. Note that even for guest users, a cookie is set with a session hash and lastvisit timestamp. This means that immediately after you've removed all cookies, 2 new ones will be set containing that data. They won't be tied in any way to your account info.
So what cookies are removed?
- username
- password (which was encrypted when stored)
- lastvisit
- sessionhash
- threadview list
- h
Resurrecting the dead here, but this came in useful today. The admins in this one computer lab I use finally found their brains and disabled access to internet options in IE (other stuff had been disabled long ago) and I don't know of another way to delete cookies....and I *hate* leaving a trail with my usernames and passwords on computers. So...I just wanted to say: thanks!