71–80 of 121 posts
Earlier quoted context omitted.
That's not the half of it - if you knew what that cookie contained…
Like... login and cleartext password, to lookup your profile on each request?
Came across this last year... have seen variations of it over the last 15+ years, but saw it in 'new' code last summer. :/
Earlier quoted context omitted.
As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.
Yes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.
At least for most of those the login is a separate protected page rather than a https iframe.
How about "Ads over HTTPS, please"? Can't upgrade our sites if our ad revenue drops through the floor.
I have recently deployed Content Security Policy (CSP) on a website. When I first looked at violation reports, my jaw dropped. The amount of malware (rouge extensions, toolbars, viruses, ...) that is blocked is staggering. If you really want to help your (clueless) users, never ever serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see "Kas…
This does mean that currently CSP can stop various malware-ish extensions, but also that it stops legitimate ones (e.g. say an extension wants to apply a certain font that the user finds more readable to the entire page). It's a tough tradeoff.
Earlier quoted context omitted.
Yes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.
This is because most people are browsing and not buying, so the caching advantages of unsecured catalogue pages is likely quite large. At least for most of those the login is a separate protected page rather than a https iframe.
How about "Ads over HTTPS, please"? Can't upgrade our sites if our ad revenue drops through the floor.
So, "figure out a new way to advertise." Welcome to disruption.
Wow, this is still even a thing. The form, all its js assets and form api endpoint all have to be secured. And https for everything that contains code. Deploying SRI for web pages over https is also another layer of defense against js tampering. Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords/passphrases could be salted hashed by the browser in Ja…
Earlier quoted context omitted.
Like... login and cleartext password, to lookup your profile on each request?
$sql = "select * from user where username='".$_COOKIE['username']."'"; Came across this last year... have seen variations of it over the last 15+ years, but saw it in 'new' code last summer. :/
Google too is about to start shaming non-HTTPS connections (according to a recent article).
I've heard about the free one-year Cert. Is there any way to do HTTPS all in-house (permanently), without resorting to an external agency?
Earlier quoted context omitted.
Yes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.
This is because most people are browsing and not buying, so the caching advantages of unsecured catalogue pages is likely quite large. At least for most of those the login is a separate protected page rather than a https iframe.