At the moment you are sending user=username&password=md5(password) over a non-secure connection (http) – obviously no way around this, so you should really be doing something a bit more secure then a single md5() encryption technique.

You should also serious consider a bit of security on your end to defeat middle-man packet stream captures. A good start to this would be the detection of certain key variable names (sid, username, password, phpsession, etc, etc) from the http_referral. As it is, any (ignorant/newbiew) programmer who uses the _GET method to allow values to be passed through are seriously opening their systems up to even greater amount of middle-man spoof when their visitors are using myStickes. While I would agree this is not something that *should* fall on your shoulders, as a group that hopefully desires to keep a good reputation, it should be your goal to take the higher road. Stripping out very unnecessary values from the http_referral should be action you take. I say “very unnecessary” because these type of sites/pages are normally such that the end-user is *never* going to be able to revisit that *exact* page – due to the variance of session values. (which brings up the issue of saving stickes on pages where folks log in, and the web developer passes session id’s through the URI’s… this will make it impossible for them to ever revisit that exact page. Of course their sticky note will still be in their mySticky Dashboard.

Anyway, I am loving the service you provide. As an enterprise software developer, I just see a lot of things you should seriously consider to strengthen the overall security of your service – not because it is insecure if you do not, but because it’s the right thing to do.

To recap, I would suggest three things:

(1) Single md5 hashes have been known to be breakable (phpBB learned that on the hard way),

(2) Stripping unnecessary http_referrals can thwart middle-man packet-sniffers, and,

(3) Finding a way to deal with stickies on session-based pages is something to ponder on… I sure cannot think of a way to deal with that properly, unless you start assigning a GUID with each and every domain and based stickies on both the exact URL and GUID values. (ugghh, not pretty, but might actually prove to work)

Again, love the service!
Yokhannan

http://www.netscraps.com

My app doesn’t do cross-site notes though .. but on the other hand it’s compatible with most popular browsers including IE, FF & Safari.

-Wick

I’d also suggest that you put a little more info on the homepage for the app. You have sign up links, but you don’t mention the requirements or how you store your data or anything. I found this page from digg.

Paul