18

The meta question page that I'm on right now seems to be https by default. However, when you go to change your SE password, it is plain http. This seems like an oversight to me. I know that in the past the admins have maintained that https for everything has a negative effect on the speed of the site, but of ALL places to use SSL, changing passwords would seem to be high on the list!

Besides the danger of someone sniffing the packet containing your new password, if someone uses a plug-in like Firesheep (or their own know-how) to get your SE cookie and use it before it expires, they can log in as you. And then it's a couple clicks and they've changed your password and/or removed your email.

I think SE should think about making https the default, but at the very least, sensitive information should be passed through https. That means login screens as well as password change screens.

Also, maybe SE should send out a password reset email instead? That would add another layer of security and it's pretty common practice, no? It's not like people change their SE passwords all the time, so it wouldn't be a big server load, right?

I realize SE is not a banking site, but people still care about the content they post here, and SE should practice what it(s users) preach(es).

  • Hold up a sec. We do send password reset emails to folks who lost access to their accounts. And if I go to "change password" from "my logins" on my profile, the page I end up on uses https. (Although we should probably require people to enter the current password there as well.) If don't want to post the specifics here in public, you can email me privately - anna@stackexchange.com. – Adam Lear Aug 15 '14 at 21:04
  • @Anna Try going to the change password page from a SE site that isn't https. When I went there from, e.g. security.stackexchange.com, it was http. It should be changed so that regardless of whether you're on http or https, when you click the link to change your password it switches to https. EDIT: Actually, the password change page is http on meta too if you start from a meta.SE page using http. – AmadeusDrZaius Aug 15 '14 at 21:06
  • 2
    Oh, derp. Yeah. We need to fix that. – Adam Lear Aug 15 '14 at 21:26
14

Oh hey, thanks for catching that. The fix is rolling out right now, and we'll be forcing https when someone clicks "change password" from the "my logins" pop-up.

  • 2
    Schweet. That was fast. – AmadeusDrZaius Aug 15 '14 at 22:20
  • 1
    It would be so cool just spending a day watching how y'all handle your deployments. I'm fascinated by the fact that you can deploy a bug fix on a platform as large as this in just under two hours! – jmort253 Aug 16 '14 at 9:09
  • 1
    @jmort253 It went roughly like this: fix the code locally, grab Dalgas for a code review/sanity check over a Google hangout, push out to dev tier and re-test with SSL certs in place, then build out to meta, re-test, then build to the rest of the network. Barring anything unusual, deploying new code network-wide takes about 7-10 minutes in build time. Nick summed up the steps on his blog here. – Adam Lear Aug 17 '14 at 0:57
  • 1
    Thanks for sharing that in-depth explanation, @AnnaLear. It's amazing the amount of dedication you all put into keeping this machine humming. :) – jmort253 Aug 17 '14 at 3:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .