PeeaycHPee

Chris posted about Secure Logins, last week. In it, he describes the confusion that exists when users cross from HTTP to HTTPS via forms.

Chris isn't alone in noticing this problem. A few weeks ago, on the Security Now! podcast, Steve Gibson answered a user question about the same problem.

On Chris' blog, I mentioned that this would be a good use for Greasemonkey. (If you don't know about Greasemonkey, you should definitely check it out.)

Since then, I've had two flights, and took a little time to work out a solution to the problem.


When hovering a form button, image or submit input, you'll see a description of the form's action, and various potential problems (onsubmit, onclick, etc).

It doesn't solve all "hijacking" problems, but it's not supposed to.. it's just a quick indicator of where your form probably posts.

Even if you're not interested, take a look at the source for a cool little embedded image trick.

Enjoy.

S

There's been a blip on the PHP blogosphere (think what you will of that word, it's accurate) regarding PHP's "inherent security flaws."

I guess it's time to toss in my 2c (even though I was one of the first to reply to Chris' post on this). Since I like similes, I propose the following: coding is like driving.

You've probably heard about the recent Windows vulnerability in WMF, by now. You might've even heard about Steve Gibson's allegation that Microsoft put this in, intentionally, as a back door.

This interests me, but what interests me more is this:


I wouldn't have expected this from a hard-line Microsoft and Windows proponent like Gibson. It's no news that the tides are turning.. but maybe... just maybe: they've turned.

S