3 ms·
If you simply go to that login, but s/http/https/, voila! ssl! I was initially confused by your question, apparently HN is always using https for me.
by bradfa 14y ago
If you simply go to that login, but s/http/https/, voila! ssl!
I was initially confused by your question, apparently HN is always using https for me.
- drcode 14y agoWell, it's definitely http by default for me, but I agree completely that a knowledgeable person would switch to https before logging in.
- Firehed 14y agoAnd a knowledgeable developer would do that automatically. It's not a user's job to know to do this, and it's not a developer's job to train users to know this. You need security turned on by default, end of discussion. Is HN a site with sensitive information? Not particularly, unless you put way too much faith in your karma. That doesn't make a default behavior of sending passwords over plaintext excusable. And despite most HN users knowing better, I guarantee there's plenty of password re-use here (hopefully re-use of the throw-away password that most people have, but that does't make the situation any more acceptable).
- manuscreationis 14y agoI would imagine it should be trivial to have the application automatically switch a user over to ssl when attempting to login, as a lot of applications do this. Maybe it's PGs way of teaching people to think about security by making it something they need to "opt-in" to, but that seems like a fairly strange line in the sand to draw.