4 ms·
There is (of course) a Tumblr site for sites that do this[0] I found a bunch of local websites including utilities and email providers that do this[1] and seem
by tombrossman 11y ago
There is (of course) a Tumblr site for sites that do this[0]
I found a bunch of local websites including utilities and email providers that do this[1] and seem completely unaware of the risk. Emailing them to explain the problem didn't help much as the vast majority simply ignored me. Hopefully this will make it into all the mainstream browsers soon because not protecting sensitive data with HTTPS is really inexcusable in 2016. It's not like it costs a lot of money to do.
[0]http://httpshaming.tumblr.com/ http://httpshaming.tumblr.com/
[1]http://insecure.org.je/ http://insecure.org.je/
And yes I see the irony in having an HTTP site for this, but at least Tumblr does a proper HTTPS form post action...
- K0nserv 11y agoThat's great. I've been thinking about and even prototyping something like httpoffenders.com. Glad to hear it's already beeen done
- tombrossman 11y agoYeah, mine is a shameless copy of the Plaintext Offenders Tumblr (http://plaintextoffenders.com/ http://plaintextoffenders.com/) which I've known about for years, but I wish I had spotted the HTTP Shaming one earlier as I would have saved myself time and submitted the local sites there instead. Oh well.
- Klathmon 11y agoI really love what plaintextoffenders is trying to do, but i've lost all confidence in it. Most of the sites on there are because of things like they will email you a temporary password forcing you to change it on first login. Digital ocean has a big red banner because if you don't provide a private key, they send you a randomly generated root password for new servers you make. FFS apple.com is on their list because someone SENT IN an email with their username and password for their phone on it, and they replied with a "work authorisation" letter that included the message they sent it... That's not what it's meant to stop...