"The whole Droplr stack runs on HTTPS" ...except content

#1

Post by spwert » Tue, Jul 10, 2012, 9:21 PM UTC

"The whole Droplr stack runs on HTTPS" ...except content
support.droplr.com

Re: "The whole Droplr stack runs on HTTPS" ...except content

#2

Post by peapicker » Tue, Jul 10, 2012, 10:37 PM UTC

No content protection is a huge oversite. I hope they re-prioritize this one -- they should care that their customer's data isn't secure on public networks.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#3

Post by ambirex » Tue, Jul 10, 2012, 10:45 PM UTC

It really shouldn't be a major issue to fix, I've encountered this before.

Since they are using S3 (guessing by the second to last comment - http://support.droplr.com/discussions/suggestions/153-https#...) they can use amazon's SSL url

so: http://files.droplr.com/files_production/acc_1927/xkcd?AWSAc....

would become: https://s3.amazonaws.com/files.droplr.com/files_production/a...

The only reason not to would be to hide the fact they are using S3, but the AWSAccessKeyId tips their hand anyways.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#4

Post by drivebyacct2 » Tue, Jul 10, 2012, 10:49 PM UTC

What's the point of even using HTTPS if the content in question (and worth protecting) is served via HTTP. The way the support person misunderstands repeatedly and then plays it off as "That's what I meant, duh, we don't care" is pretty tacky.

"Oh, I'm sorry, I misunderstood." changes the entire tone of the post. It's not like this is even hard to fix.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#5

Post by natrius » Tue, Jul 10, 2012, 10:52 PM UTC

ambirex wrote: post #3

It really shouldn't be a major issue to fix, I've encountered this before. Since they are using S3 (guessing by the second to last comment - http://support.droplr.com/discussions/suggestions/153-https#... ) they can use amazon's SSL url so: http://files.droplr.com/files_production/acc_1927/xkcd?AWSAc... . would become: https://s3.amazonaws.com/files.droplr.com/files_production/a... The only reason not to would be to…

The combination of the wrongness expressed in that thread and how easy it is to fix made it excruciating to read. I'm embarrassed for them. You can't say on your homepage, "Everything you share is stored secure and safe in the cloud" then say that security isn't a high priority.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#6

Post by anacrolix » Tue, Jul 10, 2012, 10:57 PM UTC

"it's all https"

later: "it's all https except parts that require us to configure ssl correctly"

Re: "The whole Droplr stack runs on HTTPS" ...except content

#7

Post by eridius » Tue, Jul 10, 2012, 11:12 PM UTC

Why do they keep closing the request? It's obviously a problem. The fact that they seem so willfully ignorant makes me rather nervous about relying on droplr for anything.

Edit: Looks like they're fixing the problem after all. It's unfortunate that it took a Hacker News article to bring attention to the problem, but at least they're taking the appropriate steps.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#8

Post by therealarmen » Tue, Jul 10, 2012, 11:16 PM UTC

The reason why the content itself is not served under https is precisely to avoid the SSL warning. As I've said before, this particular issue is not high priority right now, which doesn't mean we're not aware or aren't going to fix it.

Something about the tone of this response irks me.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#9

Post by chubs » Tue, Jul 10, 2012, 11:19 PM UTC

In their defence:

* Who uses a free file sending service for critical docs? * The only mention of 'secure' on their homepage has (to my mind) more of an implication of "safe and secure eg your file won't be lost" rather than "secure from hackers"

I think it's forgivable, at least for the free version of the service. Maybe they should upgrade then tout the paid version as offering https as a benefit.

Re: "The whole Droplr stack runs on HTTPS" ...except content

#10

Post by Kudos » Tue, Jul 10, 2012, 11:27 PM UTC

chubs wrote: post #9

In their defence: * Who uses a free file sending service for critical docs? * The only mention of 'secure' on their homepage has (to my mind) more of an implication of "safe and secure eg your file won't be lost" rather than "secure from hackers" I think it's forgivable, at least for the free version of the service. Maybe they should upgrade then tout the paid version as offering https as a benefit.

I run a similar service, SSL is available to everyone right now, though it defaults to plain HTTP.

Your suggestion is actually what I have in the works, SSL by default for everything premium users touch (and the files they share).