3

Why can't I access SO and others through https? I believe it should have a https interface.

0

1 Answer 1

6

Hmm. I can't see a compelling reason for this.

Your login is handled through your OpenID provider, so somebody eavesdropping on the communication between SO and you would not be able to get your password.

As far as I can see, all interaction with the SO site is stuff that is visible publicly anyway, except for votes, flags and ignored tags and such. That is private info, but hardly so security relevant that encrypted communication would make sense. Is it?

4
  • 2
    Same reason as to why google has https access to search - what pages you visit and when is not publicly available information.
    – eddi
    Commented Apr 11, 2013 at 23:35
  • How does the site associate your request with you OpenID account? Cookies. They are sent as HTTP headers, thus easy to eavesdrop on unencrypted connection. See session hijacking @ Wikipedia. Are there any countermeasures to handle this?
    – Palec
    Commented Jan 24, 2014 at 17:09
  • @Palec my main point was that the potential damage from a hijacked session on Stack Overflow is very small, compared to a GMail account. But full SSL support is planned now: Better HTTPS support for Stack Exchange sites
    – Pekka
    Commented Jan 24, 2014 at 17:11
  • @Pëkka Just reading through that. I noticed that HTTPS works, but sometimes a HTTP link can be seen and it switches you to unencrypted connection. I noticed it in inbox. Met tip to use HTTPS Everywhere browser extension and it seems really interesting.
    – Palec
    Commented Jan 24, 2014 at 18:27

Not the answer you're looking for? Browse other questions tagged .