Login Forms Over HTTPS, Please
hacks.mozilla.org
Login Forms Over HTTPS, Please
1–10 of 121 posts
Re: Login Forms Over HTTPS, Please
#2> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.*
I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http.
Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http which is even less noticeable.
There's also a more detailed post [0] with reasons and explanations. You can enable this setting in Firefox 44+ by setting `security.insecure_password.ui.enabled` to true.
0: https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-...
Re: Login Forms Over HTTPS, Please
#3> If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to deliver* the form over HTTPS too.* I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http. Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http…
As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.
Re: Login Forms Over HTTPS, Please
#4I wish they outlined a plan to push this icon out to Stable. Even better the plan should call for the browser to eventually refuse to submit forms with password fields unless HTTPS was used for both loading the form and submitting it.
I think that developers who are still using HTTP with passwords either don't understand the implications (and a tiny icon won't help), don't care, or don't have "management buy-in" to spend the time to fix it. Having the browser force best security practices will benefit them and everyone using their websites.
Re: Login Forms Over HTTPS, Please
#5Wow, this is still even a thing.
The form, all its js assets and form api endpoint all have to be secured. And https for everything that contains code. Deploying SRI for web pages over https is also another layer of defense against js tampering.
Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords/passphrases could be salted hashed by the browser in JavaScript using a PBKDF similar to scrypt or bcrypt, before being sent to the backend for constant-time comparison... it just takes a little more prudence and effort, but it's absolutely doable.
Re: Login Forms Over HTTPS, Please
#6I don't think many people pay much attention to the address bar, let alone a little lock icon with a red line through it.
If they want to get serious about it, they should just disable http support and require https for all actions. Or throw up a big in-your-face warning on http pages, not just make a small change to an obscure icon that nobody really understands.
Re: Login Forms Over HTTPS, Please
#7I don't think many people pay much attention to the address bar, let alone a little lock icon with a red line through it. If they want to get serious about it, they should just disable http support and require https for all actions. Or throw up a big in-your-face warning on http pages, not just make a small change to an obscure icon that nobody really understands.
Another alternative is to disable forms on http pages.
Re: Login Forms Over HTTPS, Please
#8[deleted]
Re: Login Forms Over HTTPS, Please
#9[deleted]
Re: Login Forms Over HTTPS, Please
#10Wow, this is still even a thing. The form, all its js assets and form api endpoint all have to be secured. And https for everything that contains code. Deploying SRI for web pages over https is also another layer of defense against js tampering. Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords/passphrases could be salted hashed by the browser in Ja…
> Passwords/passphrases could be salted hashed by the browser in JavaScript using a PBKDF similar to scrypt or bcrypt, before being sent to the backend for constant-time comparison... it just takes a little more prudence and effort, but it's absolutely doable.
This is not safe! Now an attacker just needs to intercept the hashed password and replay that, and he gets to login without knowing what the password is.
Use https. And don't do client-side hashing, it's no improvement.