This question already has an answer here:

Why can't I access SO and others through https? I believe it should have a https interface.

marked as duplicate by blahdiblah, Toon Krijthe, Bo Persson, hims056, Lucifer Apr 12 '13 at 8:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Hmm. I can't see a compelling reason for this.

Your login is handled through your OpenID provider, so somebody eavesdropping on the communication between SO and you would not be able to get your password.

As far as I can see, all interaction with the SO site is stuff that is visible publicly anyway, except for votes, flags and ignored tags and such. That is private info, but hardly so security relevant that encrypted communication would make sense. Is it?

  • 2
    Same reason as to why google has https access to search - what pages you visit and when is not publicly available information. – eddi Apr 11 '13 at 23:35
  • How does the site associate your request with you OpenID account? Cookies. They are sent as HTTP headers, thus easy to eavesdrop on unencrypted connection. See session hijacking @ Wikipedia. Are there any countermeasures to handle this? – Palec Jan 24 '14 at 17:09
  • @Palec my main point was that the potential damage from a hijacked session on Stack Overflow is very small, compared to a GMail account. But full SSL support is planned now: Better HTTPS support for Stack Exchange sites – Pëkka Jan 24 '14 at 17:11
  • @Pëkka Just reading through that. I noticed that HTTPS works, but sometimes a HTTP link can be seen and it switches you to unencrypted connection. I noticed it in inbox. Met tip to use HTTPS Everywhere browser extension and it seems really interesting. – Palec Jan 24 '14 at 18:27

Not the answer you're looking for? Browse other questions tagged .