What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

I've recently come to understand that StackExchange protects all main (and, by extension, meta and chat) site logins with HTTPS, even though the page itself is presented as HTTP. This supposedly happens with StackExchange's OpenID provider as well as most (if not all) supported third-party providers. (I feel mine in particular is doing a good job, but I can't speak for the rest for lack of experience.) While not an ideal solution, as expressed in several Meta threads, it's a little bit better than nothing.

However, I have now found that BlogOverflow (which just happens to have been recently compromised due to an unrelated vulnerability) does not have this protection. The login page is presented as HTTP, and login details are sent in a clear HTTP POST request.

From a security standpoint this is unacceptable on principle alone. Worse, it's misleading and confusing for the users. Effectively the message is on one hand, "Our HTTP login pages are safe because the form is actually being submitted in HTTPS" while on the other there's an unmentioned caveat of "...oh, except for BlogOverflow".

Please fix this as soon as possible. Thanks.

share|improve this question
    
SE has long been working on implementing HTTPS. I don't know what's taking them so long, but it is on the table. –  animuson Jul 4 '12 at 6:30
    
@animuson I'm not asking for site-wide HTTPS, although that would be ideal. I'm just asking for protection of the login process for BlogOverflow, just like it's protected for the rest of the sites. That it's done almost everywhere else in the SE network, but not for this particular sub-set of sites, just seems ludicrous. –  Iszi Jul 4 '12 at 6:35
    
Site wide HTTPS is not needed. 99.99% of the content is freely available on the Internet. SE only needs to protect the authentication process. HTTPS consumes unneeded resources.... not to beat a dead horse or anything ;) –  jmort253 Jul 4 '12 at 6:37
1  
@jmort253 Among the remaining 0.01% percent of content is the e-mail address associated with the user's account. In the case of main sites, it could also be the user's date of birth. In the case of BlogOverflow, it could be the user's first and last name. These are all items I'm sure most people would rather not have disclosed to someone who's already gone to the trouble of sniffing their credentials or session tokens. Also, HTTPS/SSL isn't (just) about encryption. –  Iszi Jul 4 '12 at 7:00
    
@Iszi - They could just hide that information and require you to click a link to view it. That part could be loaded in an https iframe. While I did overlook those two personal items, I still think the problem can be solved without blanket https. With the amount of traffic SO gets, that could be a nightmare to maintain. –  jmort253 Jul 4 '12 at 7:02
1  
@jmort253 - Iszi was specifically not talking about blanket HTTPS, but just where it is required to protect sensitive things, like authentication credentials, personal info and the like. –  Rory Alsop Jul 4 '12 at 8:21

You must log in to answer this question.

Browse other questions tagged .