Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Login Forms Over HTTPS, Please

hacks.mozilla.org

Post reply on HN
Print view View original

11–20 of 121 posts

Re: Login Forms Over HTTPS, Please

#11

Post by r3bl »

ams6110 wrote: post #6

I don't think many people pay much attention to the address bar, let alone a little lock icon with a red line through it. If they want to get serious about it, they should just disable http support and require https for all actions. Or throw up a big in-your-face warning on http pages, not just make a small change to an obscure icon that nobody really understands.

> If they want to get serious about it, they should just disable http support and require https for all actions. Or throw up a big in-your-face warning on http pages, not just make a small change to an obscure icon that nobody really understands.

Even though I agree with you, I think that it's still a little bit too early for that. My prediction is that the browsers are going to start experimenting with this near the end of 2016 and that it'll become a part of stable versions of browsers somewhere in 2017.

Re: Login Forms Over HTTPS, Please

#12

Post by herge »

There are too many security holes and corner cases to serve any authenticated page over http. It's better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid).

And that's beside a whole rake of issues from having http and https on the same domain. It's just easier to have https everywhere.

Re: Login Forms Over HTTPS, Please

#13

Post by chimeracoder »

herge wrote: post #12

There are too many security holes and corner cases to serve any authenticated page over http. It's better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid). And that's beside a whole rake of issues from having http and https on the same domain. It's just easier t…

> It's just easier to have https everywhere.

For what it's worth, this was not true ten (or maybe even five) years ago.

I'd say it's true today, for most websites, but it's worth keeping in mind that it's a relatively recent phenomenon that HTTPS is now pretty easy to set up, use, and maintain. That wasn't always the case!

Re: Login Forms Over HTTPS, Please

#14

Post by jakub_g »

osolo wrote: post #4

I wish they outlined a plan to push this icon out to Stable. Even better the plan should call for the browser to eventually refuse to submit forms with password fields unless HTTPS was used for both loading the form and submitting it. I think that developers who are still using HTTP with passwords either don't understand the implications (and a tiny icon won't help), don't care, or don't have "management buy-in" to s…

Browser should display a scary warning popup when submitting form to http (either always, or maybe at least when there is input type=password in a form). This would be annoying enough to get management buy-in to implement https, if someone still maintains the app - better than a tiny icon.

Breaking stuff is a last resort, nuclear option. There are many forgotten, old web apps that would totally stop working and people would switch to another, less secure browser as a result.

Re: Login Forms Over HTTPS, Please

#16

Post by herge »

chimeracoder wrote: post #13
herge wrote: post #12

There are too many security holes and corner cases to serve any authenticated page over http. It's better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid). And that's beside a whole rake of issues from having http and https on the same domain. It's just easier t…

> It's just easier to have https everywhere. For what it's worth, this was not true ten (or maybe even five) years ago. I'd say it's true today, for most websites, but it's worth keeping in mind that it's a relatively recent phenomenon that HTTPS is now pretty easy to set up, use, and maintain. That wasn't always the case!

Five years ago was 2010. Other than Let's Encrypt, AFAIK, there hasn't been exactly leaps and bounds in terms of making https easier, at least for self-managed servers. It's still buy a certificate and set it up in nginx/apache/your favourite load balancer/etc.

Re: Login Forms Over HTTPS, Please

#17

Post by ams6110 »

heinrich5991 wrote: post #3
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.

Yes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.

Re: Login Forms Over HTTPS, Please

#18

Post by cyphar »

jstanley wrote: post #10
dh997 wrote: post #5

Wow, this is still even a thing. The form, all its js assets and form api endpoint all have to be secured. And https for everything that contains code. Deploying SRI for web pages over https is also another layer of defense against js tampering. Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords/passphrases could be salted hashed by the browser in Ja…

> Passwords/passphrases could be salted hashed by the browser in JavaScript using a PBKDF similar to scrypt or bcrypt, before being sent to the backend for constant-time comparison... it just takes a little more prudence and effort, but it's absolutely doable. This is not safe! Now an attacker just needs to intercept the hashed password and replay that, and he gets to login without knowing what the password is. Use h…

> Use https. And don't do client-side hashing, it's no improvement.

Well, it's an improvement if your users are reusing their passwords. Then multiple different sites will have different hashes sent.

But that's all besides the point, we should've been using zero knowledge proofs for authentication since the beginning.

Re: Login Forms Over HTTPS, Please

#19

Post by geostyx »

herge wrote: post #16
chimeracoder wrote: post #13

Earlier quoted context omitted.

> It's just easier to have https everywhere. For what it's worth, this was not true ten (or maybe even five) years ago. I'd say it's true today, for most websites, but it's worth keeping in mind that it's a relatively recent phenomenon that HTTPS is now pretty easy to set up, use, and maintain. That wasn't always the case!

Five years ago was 2010. Other than Let's Encrypt, AFAIK, there hasn't been exactly leaps and bounds in terms of making https easier, at least for self-managed servers. It's still buy a certificate and set it up in nginx/apache/your favourite load balancer/etc.

I have found Caddy (https://caddyserver.com) really helpful in this regard. By default it grabs a Let's Encrypt cert and serves your site over HTTPS (oh and it handles renewals too.) Caddy + LetsEncrypt = easy https everywhere :D

Re: Login Forms Over HTTPS, Please

#20

Post by rosalinekarr »

The best solution is just to make everything use HTTPS. Using HTTPS for all traffic also helps to obfuscate which connections are the important ones.

Certain unnamed three letter organizations and nation states have the computing power to crack HTTPS encryption if they really want to, but using that power is expensive. Making sure all your traffic is encrypted makes it a lot harder for potential snoops to decide which traffic is worth spending the time and money decrypting and which isn't.

By using strong encryption for everything, even just reading wikipedia pages, you're doing everyone a favor by helping to make user privacy that much harder to violate.

Post reply on HN