5 deleted 25 characters in body
source | link

The meta question page that I'm on right now seems to be https by default. However, when you go to change your SE password, it is plain http. This seems like an oversight to me. I know that in the past the admins have maintained that https for everything has a negative effect on the speed of the site, but of ALL places to use SSL, changing passwords would seem to be high on the list!

Besides the danger of someone sniffing the packet containing your new password, if someone uses a plug-in like Firesheep (or their own know-how) to get your SE cookie and use it before it expires, they can log in as you. And then it's a couple clicks and they've changed your password and/or removed your email.

I think SE should think about configuring apache to makemaking https the default, but at the very least, sensitive information should be passed through https. That means login screens as well as password change screens.

EDIT: Also, why doesn'tmaybe SE should send out a password reset email instead? That would add another layer of security and it's pretty common practice, no? It's not like people change their SE passwords all the time, so it wouldn't be a big server load, right?

I realize SE is not a banking site, but people still care about the content they post here, and SE should practice what it(s users) preach(es).

The meta question page that I'm on right now seems to be https by default. However, when you go to change your SE password, it is plain http. This seems like an oversight to me. I know that in the past the admins have maintained that https for everything has a negative effect on the speed of the site, but of ALL places to use SSL, changing passwords would seem to be high on the list!

Besides the danger of someone sniffing the packet containing your new password, if someone uses a plug-in like Firesheep (or their own know-how) to get your SE cookie and use it before it expires, they can log in as you. And then it's a couple clicks and they've changed your password and/or removed your email.

I think SE should think about configuring apache to make https the default, but at the very least, sensitive information should be passed through https. That means login screens as well as password change screens.

EDIT: Also, why doesn't SE send out a password reset email instead? That would add another layer of security and it's pretty common practice, no? It's not like people change their SE passwords all the time, so it wouldn't be a big server load, right?

I realize SE is not a banking site, but people still care about the content they post here, and SE should practice what it(s users) preach(es).

The meta question page that I'm on right now seems to be https by default. However, when you go to change your SE password, it is plain http. This seems like an oversight to me. I know that in the past the admins have maintained that https for everything has a negative effect on the speed of the site, but of ALL places to use SSL, changing passwords would seem to be high on the list!

Besides the danger of someone sniffing the packet containing your new password, if someone uses a plug-in like Firesheep (or their own know-how) to get your SE cookie and use it before it expires, they can log in as you. And then it's a couple clicks and they've changed your password and/or removed your email.

I think SE should think about making https the default, but at the very least, sensitive information should be passed through https. That means login screens as well as password change screens.

Also, maybe SE should send out a password reset email instead? That would add another layer of security and it's pretty common practice, no? It's not like people change their SE passwords all the time, so it wouldn't be a big server load, right?

I realize SE is not a banking site, but people still care about the content they post here, and SE should practice what it(s users) preach(es).

4 edited title
| link

Why doesn't SE default to https for the change password resetpage?

3 edited tags
| link
2 added 54 characters in body
source | link
1
source | link