1

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to get your password who are always in between you and the server you request data from. If you are in a crochet forum, there will be millions of euros being spent to get your password, even if you are a 90 years old granny with no money.

Same with sending passwords via email.

Given the fact that SSL certificates are costly, how should those two security issues be judged:

When is it necessary to have SSL?

Should you never send passwords using mail?

Improve this question
15
  • 3
    Never send password using mail, unless they’re temporary passwords for reset purposes. If you have the user’s password in plaintext, you are storing it wrong. If you’re sending the registration password with the registration e-mail, don’t, because nobody cares.
    – Ry-
    Jun 12, 2013 at 23:12
  • 1
    You can get SSL certificates, that are accepted by all common browsers, free of charge.
    – Hendrik Brummermann
    Jun 12, 2013 at 23:34
  • 3
    @HendrikBrummermann Please clarify.
    – Zurechtweiser
    Jun 12, 2013 at 23:41
  • 5
    "If you are in a crochet forum, there will be millions of euros being spent to get your password, even if you are a 90 years old granny with no money." I don't need millions of euros to get at your password if you aren't using SSL. A simple tablet or laptop will do.
    – user10211
    Jun 12, 2013 at 23:54
  • 2
    StartSSL offer free certs and are well supported by browsers.
    – Ladadadada
    Jun 13, 2013 at 6:48

3 Answers 3

Reset to default
10

As a rule, if you run a website that requires authentication, you should run SSL. And I'd debate your statement that SSL certificates are costly...I've just purchased one for a personal website of mine for less than 15 euros for two years. It's cheaper than the domain name is, in fact.

You shouldn't send passwords via email either. It's slightly more secure to email password reset links instead.

The real issue is not that someone might get Granny's forum password, but that Granny is statistically likely to have used that same password for her banking website. And we can't have that stolen.

Improve this answer
5
  • "I've just purchased one for a personal website of mine for less than 15 euros for two years" Where?
    – Zurechtweiser
    Jun 12, 2013 at 23:25
  • 1
    @Zurechtweiser Comodo, via my registrar, namecheap.com. It cost me $17.90 US for a two-year cert.
    – Xander
    Jun 12, 2013 at 23:28
  • I wrote "granny with no money." you wrote "but that Granny is statistically likely to have used that same password for her banking website". Your statement makes no sense.
    – Zurechtweiser
    Jun 14, 2013 at 22:57
  • 2
    @Zurechtweiser The point is, you have to protect your users. All of them. The fact that one (or many) of them may not have much money, and that your site doesn't directly deal with their money is completely irrelevant. It's just an excuse for running a website irresponsibly, not a reasonable argument.
    – Xander
    Jun 14, 2013 at 23:08
  • It is pretty relevant as ssl slows a network down aswell as it raises exceptions in some browsers. In firefox a totally legitimate thwate certificate is shown as a certificate for an "unknown company". Without the certificate it wouldn't have even shown the message. People are more likely to not visit the site after that message than having been presented with no message at all. As even ssl-protected sites can be easily observed with Firesheep I see almost no use in using this protection at all.
    – Zurechtweiser
    Jun 14, 2013 at 23:56
7

Spilling the session token over an insecure channel, such as HTTP, is a violation of OWASP a9 and can be used to compromise an authenticated session (Firesheep). The password, and every request that contains a session token must be transmitted over HTTPS.

If your web application uses authentication, HTTPS is mandatory.

Improve this answer
4
  • 2
    "If your web application uses authentication, HTTPS is mandatory." I'll never get bored of hearing your answers/comments about HTTPS. +1
    – Adi
    Jun 12, 2013 at 23:23
  • 3
    Mandatory as in use HTTP go to jail? Will OWASP take away my library card?
    – this.josh
    Jun 13, 2013 at 6:23
  • 1
    Depending on the use of your website, at best you will have informed users not using it because of shoddy security practices. At worst, it might make you liable for damages far beyond a lifetime's SSL cert renewal costs. (if you also take credit cards You could be on the hook for a lot of lost money and fines.)
    – Rod MacPherson
    Jun 13, 2013 at 23:27
  • @this.josh Rod has a good point. Depending on your application it could be against the law. More importantly by not doing this you look like a very weak target that doesn't give a damn about even the most basic steps to protect your users.
    – rook
    Jun 14, 2013 at 0:32
2

Cost is relative, good certificates aren't cheap, and perhaps 'good enough' certificates aren't very pricey...but as to the password question, IMO, you should NEVER email someone their password - you shouldn't be able to Any online service that was able to email me my forgotten password I cancel my account and move on; had to do it several times. Shows a fundamental lack of security awareness, especially if they are also holding you CC and/or other personal information.

If they can email you the password, they are not storing it correctly.

Improve this answer
3
  • Are there ways to use php frameworks that do solve those security issues for you?
    – Zurechtweiser
    Jun 13, 2013 at 0:06
  • 1
    There's no significant technical difference in the performance of an expensive cert vs. an inexpensive cert. This has been comprehensively discussed on this site in the past.
    – Xander
    Jun 13, 2013 at 0:13
  • 1
    @Zurechtweiser: 'bolt-on' solutions don't solve security problems. Rely on a framework to guide you to creating more structured applications and reduce the amount of programming effort you need to do - you should never assume they will fix your problems for you / that you don't need to understand how they work in s much detail as your own code.
    – symcbean
    Jun 13, 2013 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .