What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I see the login page recently got an upgrade and the site started supporting https.

First off: That's great! I've been waiting for this for years. Unfortunately it also came with some issues.

Old login process

  1. Click login at the top of the page or after hitting the upvote button while logged out
  2. Click the Stack Exchange logo
  3. If I got lucky, this logged me in. Otherwise, hit "submit" (credentials are automatically filled in by Firefox' encrypted password storage)
  4. Upvote, comment, or do whatever else I wanted to do

New login process

  1. Click login at the top of the page or after hitting the upvote button while logged out
  2. Click the Stack Exchange logo
  3. If this is the first time I visit the site, I have to type my credentials and store them again (due to the domain change; previously it was all an iframe to Stack Exchange, now the login form is site-specific). If it's not the first time, I just have to hit submit.
  4. I'm returned to the homepage of whichever SE site I'm logging in on
  5. Drag down the browser's back button and select the page where I came from
  6. F5 the cached page so it recognizes me as logged in
  7. Upvote, comment, or do whatever else I wanted to do

Besides that not returning to the previous page is an obvious bug (it worked in the past), it wouldn't be so bad if I didn't need to login so often. I'm partially bringing this on myself, but I automatically remove cookies from all sites that are not on a white-list. This prevents some tracking, but more importantly, protects me from cookie hijacking. It's trivial on almost every network (open wifi hotspots, ones with shared passwords, or the wired network at school/work) to inject an iframe into an http website and load sites like Stack Exchange, thereby capturing whichever cookie it uses. I've had this happen at a forum where I was an admin, and I can tell you that the community was not happy. Whatever was left of it anyway. Similarly, on the IT Security Stack Exchange website I have >5k reputation, allowing me to do some things normal users can't. I wouldn't like to see those abused, and nor would the community.

So I'm not going to add Stack Exchange to my cookie white-list until hijacking is no longer possible (at a minimum, set the cookie to secure only), and until then I'll need to login for almost every upvote.

I could just stop voting, which is the easy option for me, but it wouldn't be fair to the people that put time into asking the question or writing the answer.

So yeah, that's my rant. In short:

  • Bug: The login page no longer redirects back to where I came from.

  • Bug: If you switch to https only after logging in, at least lock the cookie to https only. Otherwise it only adds marginal security at best.

  • Feature request: Just force https for all sites and all pages and set an HSTS header. It prevents attacks like sslstrip and other script-kiddie tools. I personally check the lock icon and domain upon logging in, but how many people actually do that?

share|improve this question
    
The redirect issue has been fixed - as for the https cookie - we are still not fully ready on https support, so that may have to wait. –  Oded Mar 3 at 14:11
    
@Oded Thanks for the update! –  Luc Mar 3 at 19:07

You must log in to answer this question.

Browse other questions tagged .