Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Login Forms Over HTTPS, Please

hacks.mozilla.org

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Login Forms Over HTTPS, Please

#51

Post by iancarroll »

mrfusion wrote: post #48
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

So how do you avoid this?

Force TLS on all pages and subdomains, send the Strict Transport Security header, and preload your site (https://hstspreload.appspot.com/).

Re: Login Forms Over HTTPS, Please

#52

Post by [deleted] »

mrfusion wrote: post #48
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

So how do you avoid this?

[deleted]

Re: Login Forms Over HTTPS, Please

#54

Post by sbierwagen »

rosalinekarr wrote: post #20

The best solution is just to make everything use HTTPS. Using HTTPS for all traffic also helps to obfuscate which connections are the important ones. Certain unnamed three letter organizations and nation states have the computing power to crack HTTPS encryption if they really want to, but using that power is expensive. Making sure all your traffic is encrypted makes it a lot harder for potential snoops to decide whic…

  Certain unnamed three letter organizations and nation 
  states have the computing power to crack HTTPS encryption 
  if they really want to
Some ciphers and key lengths are vulnerable, but I do not believe it to be true to say that the NSA can "crack HTTPS", outside of a suborned-CA MITM attack, which isn't at all deniable or subtle.

Re: Login Forms Over HTTPS, Please

#56

Post by _jomo »

mstade wrote: post #41

Prominent? A crossed over lock icon in the address bar? Try again. A prominent warning would be something ridiculous, like a full page cover saying "THIS PLACE IS NOT SECURE – HERE BE DRAGONS!" or something. Browser vendors should do more of this for egregious errors on the publisher's side. Unless users complain loudly that stuff is uncomfortable and broken and scary and what not, you can write articles like this ev…

Would be an interesting thing to do as a network operator - doing MITM to alert people about the dangers of HTTP.

Re: Login Forms Over HTTPS, Please

#57

Post by mhw »

I'm puzzled. As a developer the sites I work on are (mostly) going to be hosted on my local machine. I usually don't bother with all the effort to set up SSL certificates for my development web server unless I've got an SSL-specific issue to investigate. Is this feature disabled for sites that are local? If not I'd expect I would just come to ignore it quite quickly. Then when I then look at the production version of a site I'm more likely to continue to ignore it as I've been conditioned into assuming it's a false indicator.

At the same time, for normal web users I can see how such a warning could be helpful. But it seems normal editions of Firefox won't have this enabled by default.

Or are my development practices unusual in some way?

Re: Login Forms Over HTTPS, Please

#58

Post by underbluewaters »

jordanlev wrote: post #31

I don't understand the distinction between the login form and every other page of the site. If someone is logged in and then back to normal http, someone can just grab the cookie and pretend to be that person already-logged-in. I suppose if one uses the same password for every account they have then knowing their password is more harmful than just having access to 1 site... but other than that it seems like a distinc…

You answered your own question. If a site works this way it is risking the privacy of user data on itself, but at least it isn't endangering the credentials which may be useable to attack other sites.

Re: Login Forms Over HTTPS, Please

#59

Post by ajanuary »

joosters wrote: post #35
eterm wrote: post #21

Earlier quoted context omitted.

For too long popular a lot of popular gambling sites such as betfair and skybet have done this. I think betfair now is all https, but I'm not sure of skybet (and I can't be checking while at work).

Betfair is finally using all https. Their security was terrible because once you logged in, the site went back to http again. This meant that anyone on the same network could grab your cookies and take over your account...

That's not the half of it - if you knew what that cookie contained…

Re: Login Forms Over HTTPS, Please

#60

Post by 6d6b73 »

_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?
Post reply on HN