When comparing an HTTP GET to an HTTP POST, what are the differences from a security perspective? Is one of the choices inherently more secure than the other? If so, why?
One reason POST is worse for security is that GET is logged by default, parameters and all data is almost universally logged by your webserver.
POST is the opposite, it's almost universally not logged, leading to very difficult to spot attacker activity.
I don't buy the argument "it's too big", that's no reason to not log anything, at least 1KB, would go a long way for people to identify attackers working away at a weak entry-point until it pop's, then POST does a double dis-service, by enabling any HTTP based back-door to silently pass unlimited amounts of data.