Web Security Thread

ITT we discuss web security.

>>60

The only caveat is that some sites do not let the firefox password manager work correctly because they think that they are smart or some shit.

the other caveat is that you need to have an OS running to run a password manager, so you need a separate password for OS and/or for disk encryption. my employer has bullshit rules for domain password, which is obviously used for the OS, and I don't think there's a good way of using a manager for that

Until very recently client-side certificates in TLS leaked shit like username and other stuff. I suggest we purge TLS once we make the move to client side public keys.

I agree, TLS is shit.

>As for script and pbkdf2, you can use MD5 with them.
but why not use sha3 with them?