3 ms·

The issue is that people don't always check to see if a site is secure before putting in their login credentials and so if someone does a main-in-the-middle on

by mdasen 17y ago

The issue is that people don't always check to see if a site is secure before putting in their login credentials and so if someone does a main-in-the-middle on their bank website, they might not notice that it isn't HTTPS. I'd suggest that there's another good defense (not that I think this proposal is bad). Right now, everyone turns off that "warn me before sending insecure data over the internet" warning because it would be annoying as all hell. Every form you tried to submit would give you a warning. First, I'd change it to only warn about sending a password field over an insecure connection. That's really what most people are worried about. Second, because we all have non SSL sites with passwords, allow for an exceptions list - continue warning me about sending insecure passwords, except for this site which I realize is insecure, but don't care. That way the browser is warning people about insecurely sending the information they want being sent secure. It provides them with a convenient exceptions list for places that don't use SSL and the user deems is fine for that exception.

alexkon 17y ago
Contrary to popular belief, it doesn’t make much sense to protect the password without protecting the whole session (that is, without serving most of the site over HTTPS). If just the login page is encrypted, any attacker who is now prevented from stealing your password can still obtain your session cookie that travels over plain HTTP. A compromise of a single session is bad enough for many services. Set up a filter to forward your email to the attacker’s address? Access private information? Post messages on your behalf? Change your user profile, including your email and shipping address? Usually such actions do not require password authentication when the client already has a valid session cookie. A man-in-the-middle attacker could also intercept your attempt to log out and keep using your session for as long as possible.

by mdasen 17y ago

alexkon 17y ago

Contrary to popular belief, it doesn’t make much sense to protect the password without protecting the whole session (that is, without serving most of the site over HTTPS). If just the login page is encrypted, any attacker who is now prevented from stealing your password can still obtain your session cookie that travels over plain HTTP. A compromise of a single session is bad enough for many services. Set up a filter to forward your email to the attacker’s address? Access private information? Post messages on your behalf? Change your user profile, including your email and shipping address? Usually such actions do not require password authentication when the client already has a valid session cookie. A man-in-the-middle attacker could also intercept your attempt to log out and keep using your session for as long as possible.