search

mike-hearn / useapassphrase

A random passphrase generator / website advocating for using passphrases.
http://www.useapassphrase.com
144 stars 65 forks source link

Add HTTPS #5

Closed atoponce closed 5 years ago

atoponce commented 6 years ago

The site http://useapassphrase.com really needs to be served under HTTPS, so the passphrases cannot be passively sniffed on the wire.

mike-hearn commented 5 years ago

Good point. Updated to HTTPS (though the passwords are generated client-side, so no sniffing would be possible either way).

atoponce commented 5 years ago

Thanks for fixing this.

I probably should have mentioned that HTTP-only leaves the browser open to content injection attacks, which means the adversary could inject JavaScript that could sniff the generated passwords, and send them to a logging server.