I'm curious if it would be better to move action to check hidden username and password on quickreply or message posts if done via cookie to post_info rather than leaving trail at cache as html on any topic reads.
Just brain storming. I know if someone reaches cache, it may reach cookies and such etc too, but still curious if it would be more secure than direct post for sniffers.
PS: This is not for default Snitz behaviour, just asking if modifying a behaviour would break something else.
My question was, instead of writing "input type="hidden" name="username" etc. or "input type="hidden" name="password" value=" (sha256 of pw) (say on Quick Reply) or Reply or new Topic if user logged in, would it be better to use these values at post_info, rather than posting those two and leave those values in cache html.
Moving Hidden username & password to post_info
Posted - 11 April 2009 : 06:04:30
