3 ms·
Jungle Disk support sends login credentials over http
I noticed today that Jungle Disk uses SSL. A lot. And passphrases and encryption too. Which is good.
Until you need to use support. Their support site sends your username and password over plain old http, no SSL involved. Try it: http://support.jungledisk.com/
A truly facepalming moment.
- booi 15y agoIt POSTs to a secure page. Same as many sites including facebook.com <form action="https://jungledisk.zendesk.com/access/login https://jungledisk.zendesk.com/access/login class="new_user" id="password-form" method="post">
- noja 15y agoThat's better, but it doesn't solve the problem: the username and password must be entered on a page that has been potentially modified in transit.
- travelton 15y agoJungle Disk support here... While we investigate further, we welcome you to email your request to support@jungledisk.com, circumventing the need to provide a username and password. Thanks for your understanding.