[Sugar-devel] [PATCH] webactivity: seed the XS cookie at startup

[Martin Langhoff]

On Fri, Feb 13, 2009 at 7:07 AM, Carol Farlow Lerche <cafl at msbit.com> wrote:
> Martin, I want to understand what https traffic you are concerned will
> affect performance and caching.  As far as I understand the need for https,
> it would only be used infrequently, when reauthenticating to the server.
> I.e..:

What you describe was the plan B in my earlier postings. It first does
crypto, and then falls back to a totally MITM'able cleartext cookie.
So the crypto is just a lot of programming work for a tiny gain.