HTTPS wouldn't help anything, I still have to ask you for your login details if it's going to work, still have to store it in plaintext somewhere (in a cookie), and still have to send it to newzbin in plaintext. I just baked my own login details into a local dev copy I have and it works fine, so it's just an issue of seeing how far I can lock down the cookie.bcrook wrote: Would https make this more secure? or just add unneeded cost and complication to your job.
edit: Well, HTTPS would get around the fact that I'd be requesting plaintext cookie details. But I can't add any more ssl certs to this server.
edit2: I've thought about this more throughout the day, and there's just no way to adequately secure it. I'll talk to the newzbin devs over the weekend to see what it would take to get this official, and if that falls through I'll just release the source, so you run it at your own risk.