Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7867

Re: Digest Authentication

Show all headers | View raw

On 12/19/2012 9:40 AM, dhtmlkitchen@gmail.com wrote:
> On Tuesday, December 18, 2012 6:08:59 PM UTC-8, Jerry Stuckle wrote:
>> On 12/18/2012 8:55 PM, xkit wrote:
>>
>>> On Dec 13, 8:15 pm, Jerry Stuckle <jstuck...@attglobal.net> wrote:
>>
>>>> On 12/13/2012 7:49 PM, dhtmlkitc...@gmail.com wrote:
>>
> [snip entire quoted message NOTE:
> Never fullquote on USENET (quotes the whole message, signature). QUote *only* the parts you are replying to. Otherwise, there is no dialogue; no back and forth.
>
> When replying type your reply, then review the entire message.
>
>> If you're doing ecommerce (even if you're using Paypal), you NEED to use
>>
>> https.  Otherwise your site is NOT secure.  It is too easy to intercept
>>
> What it?
>
> There are a lot of sites that navigate from http (not https) site to paypal. Are you telling me that this is a security issue? And if not, then where exactly do *you* see the security hole and what do you see being at risk (you wrote "everything" (including the moon?)).
>
>> the data being entered - i.e. someone using a wireless hot spot, on a
>>
>> cable modem at home or any of a couple of dozen other connections will
>>
>> easily allow a hacker to get everything he/she wants.
>>
> Again, what is everything [that the hacker wants]? And how does any hacker get all of these things? Please explain, if you can.
>
>>
>>
>> And if your site is hacked, the cost of NOT using it is much, much
>>
>> higher than the cost of using it.  If you can't afford it, you can't
>>
>> afford the site.
>>
>>
>>
>> Read M. Strobel's post.  And if you're not familiar with creating a
>>
> "This is a feature that is offered completely functional by the web server. " ...
>
>> secure site, hire someone who is.  This is not a job for a beginner.
>>
> Apparently noone here is qualified or willing to explain this task. I'm sure someone has made a secure site and is capable of reading, understanding, making security assessment and giving technical advise.
>
>>
>>
>> And BTW - giving a "hidden URL" is no security at all.
>>
> And that is why I advised the client to not do that, AISB.
>
  (FULLQUOTE)

Kitchen I doubt you are going to get any additional help around here 
with your attitude.
Jerry was pointing out the vulnerabilities of the code used and unless 
you have stock in that code or wrote it yourself, why get so defensive?

His points are very valid whether you disagree or dislike them.  If you 
expect FREE help for your potentially litigious issues, you may want to 
humble yourself a bit.

Scotty

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Digest Authentication dhtmlkitchen@gmail.com - 2012-12-13 16:49 -0800
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:15 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:31 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 23:15 -0500
    Re: Digest Authentication xkit <dhtmlkitchen@gmail.com> - 2012-12-18 17:55 -0800
      Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-18 21:08 -0500
        Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 09:40 -0800
          Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-19 15:02 -0500
            Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 20:59 -0800
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:02 -0500
          Re: Digest Authentication "Peter H. Coffin" <hellsop@ninehells.com> - 2012-12-19 14:30 -0600
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-19 17:26 -0500
          Re: Digest Authentication Scott Johnson <noonehome@chalupasworld.com> - 2012-12-19 17:02 -0800
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-20 20:17 -0500
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 23:10 -0500
              Re: Digest Authentication The Natural Philosopher <tnp@invalid.invalid> - 2012-12-21 10:19 +0000
          Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-20 09:57 +0100
            Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:06 -0500
    Re: Digest Authentication legalize+jeeves@mail.xmission.com (Richard) - 2012-12-22 19:15 +0000
  Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-14 12:05 +0100

csiph-web