2 ms·
Well, it's definitely http by default for me, but I agree completely that a knowledgeable person would switch to https before logging in.
by drcode 14y ago
Well, it's definitely http by default for me, but I agree completely that a knowledgeable person would switch to https before logging in.
- Firehed 14y agoAnd a knowledgeable developer would do that automatically. It's not a user's job to know to do this, and it's not a developer's job to train users to know this. You need security turned on by default, end of discussion. Is HN a site with sensitive information? Not particularly, unless you put way too much faith in your karma. That doesn't make a default behavior of sending passwords over plaintext excusable. And despite most HN users knowing better, I guarantee there's plenty of password re-use here (hopefully re-use of the throw-away password that most people have, but that does't make the situation any more acceptable).