Ask PG: Make the login form available over HTTPS only?

Re:Ask PG: Make the login form available over HTTPS only? by dagrz on Monday July 23, 2012 @04:59AM (#4280155)

For the scenerio you mentioned, just having the login/comment submissions work over SSL results in zero added security. In short, this is because of tools such as SSL strip.

A better suggestion would be to have the entire site available of SSL only. Good to see HN'ers taking security seriously though :)

[ Parent | on HN ]

Re:Ask PG: Make the login form available over HTTPS only? by k33l0r on Monday July 23, 2012 @05:08AM (#4280177)

On Google Chrome you can manually add news.ycombinator.com to the HSTS set via chrome://net-internals/#hsts. This will prevent you from accidentally going to the non-SSL version of the site.

[ Parent | on HN ]

Re:Ask PG: Make the login form available over HTTPS only? by mcpherrinm on Monday July 23, 2012 @05:07AM (#4280173)

Not quite zero. SSLstrip requires an active MITM, versus other "listen-only" attacks to snoop credentials off the wire.

[ Parent | on HN ]

Re:Ask PG: Make the login form available over HTTPS only? by kevinburke on Monday July 23, 2012 @10:47AM (#4281221)

Agreed, Firesheep demonstrated the problems with sending cookies over HTTP... it's at least a start though.

[ Parent | on HN ]