Sites use Secure Login Screens - Firefox alterts me DU Login Screen is not HTTPS, subject to hijack!

[TheBlackAdder]

.


Is anyone else getting this warning?


The userid and password I send in, as part of the login process, is NOT ENCRYPTED and visible to sniffers and line analyzers at telco offices and ISP providers. I am unable to obtain an HTTPS session for logins.


.

[Hokie]

1. This was added in Firefox Release 52

Firefox 52 release notes:

Added user warnings for non-secure HTTP pages with logins. Firefox now displays a “This connection is not secure” message when users click into the username and password fields on pages that don’t use HTTPS.

I think Mozilla is trying to encourage sites to use secure HTTP for login pages. It just means your password is not encrypted going from your computer to DU so technically a sniffer program could see your password. By using HTTPS it would be end to end encrypted.

Nothing has changed on DU. It is as secure (or not secure) as it was before.

[TheBlackAdder]

2. I saw that notice. This is my only site doing it. In light of the security breech...

.


HTTPS for initial logins was generally a site standard for a couple of years.

I believe I've raised this issue with the admins a year ago, and I sent them another email this week.


No response. I find that security is lax in a site that highlights, in yellow, a security breech on its login page.

It takes minutes to implement this, so I have no idea why the delay.


Hopefully this won't get locked, as this discussion needs to be had.


.

[GregD]

3. No SSL certificate

I just tried to force my browser to HTTPS and it did not work.

This confirms it - no SSL
https://www.sslshopper.com/ssl-checker.html#hostname=www.democraticunderground.com

I find it curious that for as inexpensive as SSL certificates are these days, that the site does not have an SSL assigned and the "my account" section absolutely forced to use that. And particularly in the light of having been hacked. WTF?

[TheBlackAdder]

4. They might use a pseudo password encryption, but those schemes are public hacker knowledge.

[Make7]

5. Skinner said it is the next item on their agenda.

http://www.democraticunderground.com/125912451