[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 17 Aug 2013 11:42:04 +0800
From: Pavel Labushev <pavel.labushev@...box.no>
To: oss-security@...ts.openwall.com
Subject: Re: HTTPS (was: rubygems insecure download (and
other problems))
On Thu, 15 Aug 2013 10:38:09 +0400
gremlin@...mlin.ru wrote:
> On 14-Aug-2013 14:59:12 -0600, Kurt Seifried wrote:
>
> > everyone should be enabling HTTPS where possible,
>
> Very dangerous mistake. HTTPS should be used only for non-anonymous
> access, otherwise plain HTTP is preferred. In any case, let the users
> choose whether they want to use it.
Well, there's a problem with HTTP -> HTTPS transition if it happens
during or after user authentication: if a login form resides on a page
obtained through HTTP, there's a opportunity for an attacker to steal
users' credentials by tampering the page's content during MitM before
the transition occurs. Of course you can redirect users to a separate
login page over HTTPS, but:
- IMHO, if they get used to HTTP and the lack of HTTPS indication
during their anonymous experience, then the chances they will check the
bar before filling the form may be lower than if they would have been
using HTTPS by default.
- Some people may consider it much less ergonomic and somewhat
contrary to the original look and feel, especially for the Pjax-based
sites.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
