Re: [xml-dev] Re: Cookies at XML Europe 2004 -- Call for Participation

>> Make sure they always connect to the site with SSL.
> 
> No, the client can't choose that.

Sure.  The client can decide not to risk the exposure.  Sure, the server 
might not do SSL, but at least the client can say "no."  With digest, 
you can't prevent the server from offering up a plaintext challenge, you 
can only agree not to continue.  So again, it's less protection.
	/r$

-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html