How to implement HTTPS in an insufficient manner

#1

Post by tomelders » Thu, Apr 04, 2013, 8:56 AM UTC

How to implement HTTPS in an insufficient manner
troyhunt.com

Re: How to implement HTTPS in an insufficient manner

#2

Post by csmattryder » Thu, Apr 04, 2013, 10:20 AM UTC

This is the same guy who exposed similar flaws with Tesco's (UK supermarket chain) systems [1].

Why on Earth these companies are given free advice, but think they (or their PR folks) know better is beyond me. Take the advice! You've now got a security flaw, documented, waiting for Joe Hacker to take your customer's data and shoot a hole through your business, and its reputation.

[1] http://www.troyhunt.com/2012/07/lessons-in-website-security-...

Re: How to implement HTTPS in an insufficient manner

#3

Post by dragcdxfbv » Thu, Apr 04, 2013, 10:52 AM UTC

Do i have to pay or create accounts on third party services to use HTTPS (in nginx)?

I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

Re: How to implement HTTPS in an insufficient manner

#4

Post by [deleted] » Thu, Apr 04, 2013, 10:52 AM UTC

[deleted]

Re: How to implement HTTPS in an insufficient manner

#5

Post by JennyZ » Thu, Apr 04, 2013, 10:55 AM UTC

dragcdxfbv wrote: post #3

Do i have to pay or create accounts on third party services to use HTTPS (in nginx)? I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

You can get a free SSL certificate at https://www.startssl.com/ , so that should not be a reason to keep you from using it.

I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing.

Re: How to implement HTTPS in an insufficient manner

#6

Post by tacticus » Thu, Apr 04, 2013, 10:55 AM UTC

dragcdxfbv wrote: post #3

Do i have to pay or create accounts on third party services to use HTTPS (in nginx)? I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

http://www.startcom.org/ has free certs for non businesses. or it's about 10$ a year for a paid one

Re: How to implement HTTPS in an insufficient manner

#7

Post by nwh » Thu, Apr 04, 2013, 10:58 AM UTC

csmattryder wrote: post #2

This is the same guy who exposed similar flaws with Tesco's (UK supermarket chain) systems [1]. Why on Earth these companies are given free advice, but think they (or their PR folks) know better is beyond me. Take the advice! You've now got a security flaw, documented, waiting for Joe Hacker to take your customer's data and shoot a hole through your business, and its reputation. [1] http://www.troyhunt.com/2012/07/le…

I emailed my ISP today to ask them why my password was being stored in plain text (and not even escaped) in a MySQL database. Their response was that everything was "working", so I didn't have to worry. Bear in mind, this is a company with my banking details.

I have absolutely no expectation that it is going to be fixed either.

Re: How to implement HTTPS in an insufficient manner

#8

Post by markhemmings » Thu, Apr 04, 2013, 11:16 AM UTC

I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post.

What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think about incorporating even the simplest foundations of internet security a novice like me would implement without even thinking! How is this possible?! If I'm doing it in tiny little php sites with 1 unique visitor ever, why are these 'experts' not in there huge corporate sites with hundreds of thousands of users a month?!

Re: How to implement HTTPS in an insufficient manner

#9

Post by claudius » Thu, Apr 04, 2013, 11:18 AM UTC

dragcdxfbv wrote: post #3

Do i have to pay or create accounts on third party services to use HTTPS (in nginx)? I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

You could also think about getting CAcert(ified?) and promote the CAcert root certificates getting included in more browsers. This is not measurably more insecure since SSL is mostly snakeoil anyways as long as you rely on external entities[0] to verify the identity of websites.

Ideally, browsers would store the certificate presented on the first visit to a website and compare the certificate presented on following visits to that stored certificate to warn the user on mismatches – so far, I have not yet found a usable implementation thereof, and especially not one more widespread than CAcert.

[0] Among them such trustworthy companies as DigiTrust, TÜRKTRUST or CNNIC.

Re: How to implement HTTPS in an insufficient manner

#10

Post by lucb1e » Thu, Apr 04, 2013, 11:23 AM UTC

Https article served over http. Lovely.

Edit: Besides that problem #1 is offtopic since it has nothing to do with https and that 3/4 other points are captain obvious, #4 is actually a good one. It's so obscure that many will forget to enable it ("all pages are secured anyway"), but whenever a user visits any http page, an attacker can inject a small frame loading the http version of my website, and even if I redirect, the cookie was already sent and read by the attacker. Only an HSTS header or enabling the secure-cookie option protect against this.