2 ms·
This appears to be a good response. On the other hand, my local government had a website that let you book and pay for driving tests online, and, presumably du
by cameronh90 14y ago
This appears to be a good response.
On the other hand, my local government had a website that let you book and pay for driving tests online, and, presumably due to a configuration error, it was taking credit card numbers over plain HTTP.
I contacted them to let them know that they were accepting credit card numbers over an unencrypted connection, and they just sent me an email saying "Thanks for your inquiry. I have been assured by our IT team that the site is secure." I sent a few more emails trying to prove to them that it wasn't secure, but then they stopped replying.
Eventually it got fixed, but I've just checked again and it's now insecure -- again.
- theonewolf 14y agoYes i know. I think the excuses like "many sites dont do this" or "its up to the users to secure passwords" are just that---excuses for poor security practices.
- adbachman 14y agoHashing on the client-side wouldn't make a difference if a MITM already has control of the SSL connection. They could just spoof the login form, swap out HackerRank's hashing code, and take your password anyway. If you don't trust the connection don't trust any part of it. Especially not the code your browser is executing.