4 ms·
The form action for registration is not https. Also, they have nothing to prevent a MITM from changing where the form action goes. Why would anyone use this...
by theboss 13y ago
The form action for registration is not https. Also, they have nothing to prevent a MITM from changing where the form action goes.
Why would anyone use this...
- jimktrains2 13y agoI see this: <form method="post" action="https://deadmansswitch.org/userhome.html"> Email:<br /> <input type="text" name="email" /><br /> Password:<br /> <input type="password" name="password" /><br /> <input type="submit" name="login" value="Log in" /><br /> <a href="/createaccount.html" title="Create an account">Create an account</a> </form> Also, what does/can anyone do to prevent a MITM attack? Even if thy sent a HSTS header or a redirect, they're still subject to that.
- theboss 13y agoThat is the login form. I'm not sure how to paste code onto hacker news so here is a pastebin of the registration form. http://pastebin.com/Ctkw6S2h http://pastebin.com/Ctkw6S2h Well a better practice would be all HTTPS for the site. There are a lot of problems with this and I will probably write a blog post about it. Everything about this site misses every best practice. 1. No CSRF tokens 2. Small secret tokens to trigger the switch. 3. passwords over http... It's a joke.
- jimktrains2 13y ago/me is unable to read :( sorry abotu that Yeah, it is. Especially since their cert is over a year dead.