Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK government's password checker sends plaintext password in the URL over HTTP

getsafeonline.org

Post reply on HN
Print view View original

1–10 of 117 posts

Re: UK government's password checker sends plaintext password in the URL over HTTP

#3

Post by facorreia »

This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance.

[1] https://www.getsafeonline.org/about-us/

Re: UK government's password checker sends plaintext password in the URL over HTTP

#4

Post by opendais »

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/

It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html

So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it?

EDIT:

Tried to contact them, got a "The form you submitted contained the following errors

Missing Data.(DIFFERENT_IP)"

error which has nothing to do with the form I submitted. XD

Could someone contact them by their contact us page to get this fixed?

Re: UK government's password checker sends plaintext password in the URL over HTTP

#6

Post by stuaxo »

facorreia wrote: post #3

This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance. [1] https://www.getsafeonline.org/about-us/

It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#7

Post by ZoFreX »

opendais wrote: post #4

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…

> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel.

There are adverts everywhere about it with obvious government endorsement.

It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"

Post reply on HN