Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Login Forms Over HTTPS, Please

hacks.mozilla.org

Post reply on HN
Print view View original

91–100 of 121 posts

Re: Login Forms Over HTTPS, Please

#91

Post by drblast »

heinrich5991 wrote: post #3
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.

You don't have to wait for the user to click anything. Just read each key press and send a message out.

Hard to believe this is still a common vulnerability. Of course, even in 2007 a significant number of bank and credit card web sites operated like this.

Re: Login Forms Over HTTPS, Please

#92

Post by detaro »

mstade wrote: post #41

Prominent? A crossed over lock icon in the address bar? Try again. A prominent warning would be something ridiculous, like a full page cover saying "THIS PLACE IS NOT SECURE – HERE BE DRAGONS!" or something. Browser vendors should do more of this for egregious errors on the publisher's side. Unless users complain loudly that stuff is uncomfortable and broken and scary and what not, you can write articles like this ev…

Use to many prominent warnings and people learn that they happen all the time and ignore them. It's a fine balance, and browser vendors invest a lot of effort in it (I know the chrome team had papers/talks on quite a few conferences about the topic)

Re: Login Forms Over HTTPS, Please

#93

Post by hackaflocka »

jakobdabo wrote: post #85
hackaflocka wrote: post #79

So, if I understand it correctly, HTTPS costs developers money (annual rent for renting an SSL Cert). Google too is about to start shaming non-HTTPS connections (according to a recent article). I've heard about the free one-year Cert. Is there any way to do HTTPS all in-house (permanently), without resorting to an external agency?

https://letsencrypt.org/

Thanks.

Re: Login Forms Over HTTPS, Please

#94

Post by hwdsl2 »

6d6b73 wrote: post #60
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?

They could. But how would they show the users their desired contents after login?

Re: Login Forms Over HTTPS, Please

#95

Post by notatoad »

hwdsl2 wrote: post #94
6d6b73 wrote: post #60

Earlier quoted context omitted.

If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?

They could. But how would they show the users their desired contents after login?

Doesn't matter, they've already gotten your password at that point. They can just say "login failed" and redirect you to the real login page

Re: Login Forms Over HTTPS, Please

#96

Post by toomuchtodo »

Pharaoh2 wrote: post #80
eterm wrote: post #72

Earlier quoted context omitted.

This is because most people are browsing and not buying, so the caching advantages of unsecured catalogue pages is likely quite large. At least for most of those the login is a separate protected page rather than a https iframe.

Uhh, what caching advantage are you talking about? Everything that can be served cached over HTTP can also be served cached over HTTPS. Unless you are talking about a caching proxy outside of the website control. In that case, they aren't needed, CDNs solved that problem in a much better way.

> Unless you are talking about a caching proxy outside of the website control. In that case, they aren't needed, CDNs solved that problem in a much better way.

There are still parts of the world where caching proxies are used to conserve limited transit bandwidth; CDNs don't solve that.

Re: Login Forms Over HTTPS, Please

#97

Post by Gratsby »

This is not a good thing. The expense of SSL certificates is not negligible, and it is not justified. The protocol is easily compromised.

Much like email, https needs to go away in favor of a solution that incorporates a modern mindset.

Re: Login Forms Over HTTPS, Please

#98

Post by kilburn »

6d6b73 wrote: post #60
_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?

That's one of the reasons why HSTS [1] was invented. Basically your website itself informs the browser to never contact it though http. Then a man-in-the-middle, which can inject whatever in any http pages you visit, simply cannot inject (nor replace) your website ever, because they (supposedly) cannot fake a valid certificate covering your domain.

You can even submit your domain [2] so that current browsers automatically apply the https-only preference to your domain, even when it hasn't ever been contacted before. Cool, isn't it?

[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [2] https://hstspreload.appspot.com/

Re: Login Forms Over HTTPS, Please

#99

Post by codazoda »

mosburger wrote: post #29

I don't know why sites don't just use HTTPS for everydamnedthing. It's 2016. SSL is not that computationally expensive and it's just easier to develop an entire site that way anyway (rather than making some pages secure and other non-secure). Just redirect everything to https and forget about it.

I work on a site with a long history. I recently created a benchmark and found that I could make around 500 synchronous HTTP requests to our infrastructure per second (essentially localhost calls). If I switch my benchmark to HTTPS I can only make about 5.

That's a big difference. I'm a developer, not a hardware guy, so I don't know what causes the slowdown for us. I assume it's the actual setup and teardown of the HTTPS connection. That is a fairly significant difference when I want to use API's via HTTP/HTTPS and I need to make a lot of calls quickly.

My point is that HTTPS still seems to be 100x more computationally expensive than HTTP.

Re: Login Forms Over HTTPS, Please

#100

Post by nommm-nommm »

_jomo wrote: post #2

> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…

The Tunisia government actually did this.

http://m.theregister.co.uk/2011/01/25/tunisia_facebook_passw...

Post reply on HN