Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread German Geek
Hi All again, What makes it so expensive to have a certificate? I mean, wouldn't it be possible to setup a new authority that doesn't charge as much or nothing at all? Wouldn't the major browsers be willing to support an authority that is free or costs next to nothing? I pay about $200 a year for

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread Michael A. Peters
German Geek wrote: OK, i hear about this self signed certificate. Whenever i signed anything it just came up with all these warnings in FF which confuses users and i think is not good at all. Can someone paste a link in here to a website with a self signed cert please? Would like to see if there

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-15 Thread German Geek
OK, i hear about this self signed certificate. Whenever i signed anything it just came up with all these warnings in FF which confuses users and i think is not good at all. Can someone paste a link in here to a website with a self signed cert please? Would like to see if there are any warnings etc.

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
Sudheer wrote: Michael A. Peters wrote: Sites (like mine) that don't want to pay a certificate authority can use a self-signed cert. Even Red Hat does for some of their stuff (IE I believe their bugzilla server) Firefox scares its users when they encounter a website with self signed certif

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Sudheer
Firefox scares its users when they encounter a website with self signed certificate. If your website users aren't worried about the warning Firefox throws at them, self signed cert works well. I just realized Dotan Cohen already mentioned this. -- With warm regards, Sudheer. S Busines

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Sudheer
Michael A. Peters wrote: German Geek wrote: Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Sites (like mine) that don't want to pay a certificate authority can use a se

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
German Geek wrote: Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Sites (like mine) that don't want to pay a certificate authority can use a self-signed cert. Even Red Hat

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread German Geek
Hi gang, Was just thinking of a cheap solution for sites that don't require absolute security. A SSL cert cost about $150 a year. Sites like facebook could use this... Of course it's not for banks etc. You could degrade gracefully when javascript is turned off to just sending the form and checkin

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
Dotan Cohen wrote: Have you seen the fit Firefox 3 makes for self-signed certs? So far as the end user is concerned, the site is inaccesible. Yes I have. That's why on my site I have an instruction page - and a demonstration of how Opera does it, which is just as secure and less of a PITA,

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Dotan Cohen
> I think just use a flippin' ssl server and be done with it. > ++$i > When I go to a website that requires me to let them execute JavaScript I > rarely go back. > Many people do this, I hope that the OP realizes this. > You can use SSL for the login and only the login - I know that it means >

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Per Jessen
Michael A. Peters wrote: > German Geek wrote: > > > What do you think? > > I think just use a flippin' ssl server and be done with it. > That was my thought too. > You can use SSL for the login and only the login - I know that it > means either using a self signed cert or paying big bucks,

Re: [PHP] for the security minded web developer - secure way to login?

2009-02-14 Thread Michael A. Peters
German Geek wrote: > What do you think? I think just use a flippin' ssl server and be done with it. When I go to a website that requires me to let them execute JavaScript I rarely go back. You can use SSL for the login and only the login - I know that it means either using a self signed cer