3 ms·

This is precisely my thought on SSL. I'm no expert (correct me if I'm wrong), but if I understand the technology correctly: if your http website connects to an

by tyleo 10y ago

This is precisely my thought on SSL. I'm no expert (correct me if I'm wrong), but if I understand the technology correctly: if your http website connects to an https login page, who is to stop someone from spoofing a link to a fake login page on the http website.

watwatwatwat 10y ago
EV certificates help.
- vtlynch 10y ago
  EV certificates may improve a user's awareness of a spoofed page, but cannot do anything to make it more technically difficult to execute. Providing an HTTPS login with an otherwise HTTP site is vulnerable to redirection to HTTP or to another site. There is lots of evidence that suggests that in this configuration, cookies are often not set up properly (secure only) and can therefore be transmitted and stolen over HTTP.
  - watwatwatwat 10y ago
    > EV certificates may improve a user's awareness of a spoofed page, but cannot do anything to make it more technically difficult to execute. This is what I meant, this is why I used "may". Obviously the user must know the details of how ssl works which is not many of them.
acdha 10y ago
This is an annoying problem – even if your entire site uses HTTPS, users could be vulnerable if they ever follow an HTTP link or their browser's autocomplete doesn't update to use HTTPS. Strict Transport Security was designed to solve that problem partially by telling the browser to never make an insecure HTTP request: http://caniuse.com/#feat=stricttransportsecurity http://caniuse.com/#feat=stricttransportsecurity That's widely supported now but it does require your browser to have previously visited the legitimate site within the stored `max-age` period. Preloading (https://hstspreload.appspot.com/ https://hstspreload.appspot.com/) can close that further but increases the organizational commitment that your web developers will never break the all-HTTPS contract by mistake.

by tyleo 10y ago

watwatwatwat 10y ago

EV certificates help.

vtlynch 10y ago
EV certificates may improve a user's awareness of a spoofed page, but cannot do anything to make it more technically difficult to execute. Providing an HTTPS login with an otherwise HTTP site is vulnerable to redirection to HTTP or to another site. There is lots of evidence that suggests that in this configuration, cookies are often not set up properly (secure only) and can therefore be transmitted and stolen over HTTP.
- watwatwatwat 10y ago
  > EV certificates may improve a user's awareness of a spoofed page, but cannot do anything to make it more technically difficult to execute. This is what I meant, this is why I used "may". Obviously the user must know the details of how ssl works which is not many of them.

acdha 10y ago

This is an annoying problem – even if your entire site uses HTTPS, users could be vulnerable if they ever follow an HTTP link or their browser's autocomplete doesn't update to use HTTPS. Strict Transport Security was designed to solve that problem partially by telling the browser to never make an insecure HTTP request: http://caniuse.com/#feat=stricttransportsecurity http://caniuse.com/#feat=stricttransportsecurity That's widely supported now but it does require your browser to have previously visited the legitimate site within the stored `max-age` period. Preloading (https://hstspreload.appspot.com/ https://hstspreload.appspot.com/) can close that further but increases the organizational commitment that your web developers will never break the all-HTTPS contract by mistake.