Re: revised "generic syntax" and "data:" internet drafts

On Fri, 4 Apr 1997, Jonathan Rosenne wrote:
> Please note that in any case, even when one uses a "password" input field
> in a form, in most cases in practice the password is transmitted over the
> wire in clear. So I don't see what is so wrong about having it in the URL.

Transmitting a password in the clear over the network is certainly a poor
security event, but it is also a transient event.  URLs usually get stored
permanently, often in the global history file.  And given the care modern
browsers have for security, I wouldn't like to have passwords hanging
around in my global history file.

Passwords in URLs are an even more serious security problem than cleartext
passwords over the net.  If they're going to remain in the "Generic
syntax", there needs to be much stronger warnings.  I'd suggest at least a
SHOULD NOT use the password field.