News for hackers. Stuff that matters.
Re:HTTPS Watch by jspaetzel on Sunday January 18, 2015 @07:02PM (#8909539)
Session hijacking only works on webpages with sessions. Most of these urls are static informational pages without sessions, from the several I looked at.
Re:HTTPS Watch by JonathonW on Sunday January 18, 2015 @07:28PM (#8909636)
The WSJ specifically requires login to view articles (because they require an active subscription to read anything on their site). Most of the other newspaper sites (at least; not going to go and pick through the whole list) are the same, with different thresholds for when login is required.
Re:HTTPS Watch by jspaetzel on Sunday January 18, 2015 @07:44PM (#8909692)
I'm not sure what happens on the site after login on WSJ, if they are doing it semi-correctly then it should be a secure page after login. If that's not the case, then yea they should improve this. Not picking through them individually, there are a number of pages outside the newspaper category that are strictly informational without even login forms.