Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to get your password who are always in between you and the server you request data from. If you are in a crochet forum, there will be millions of euros being spent to get your password, even if you are a 90 years old granny with no money.

Same with sending passwords via email.

Given the fact that SSL certificates are costly, how should those two security issues be judged:

When is it necessary to have SSL?

Should you never send passwords using mail?

share|improve this question
3  
Never send password using mail, unless they’re temporary passwords for reset purposes. If you have the user’s password in plaintext, you are storing it wrong. If you’re sending the registration password with the registration e-mail, don’t, because nobody cares. –  minitech Jun 12 '13 at 23:12
1  
You can get SSL certificates, that are accepted by all common browsers, free of charge. –  Hendrik Brummermann Jun 12 '13 at 23:34
3  
@HendrikBrummermann Please clarify. –  Zurechtweiser Jun 12 '13 at 23:41
4  
"If you are in a crochet forum, there will be millions of euros being spent to get your password, even if you are a 90 years old granny with no money." I don't need millions of euros to get at your password if you aren't using SSL. A simple tablet or laptop will do. –  Terry Chia Jun 12 '13 at 23:54
1  
StartSSL offer free certs and are well supported by browsers. –  Ladadadada Jun 13 '13 at 6:48
show 10 more comments

3 Answers

As a rule, if you run a website that requires authentication, you should run SSL. And I'd debate your statement that SSL certificates are costly...I've just purchased one for a personal website of mine for less than 15 euros for two years. It's cheaper than the domain name is, in fact.

You shouldn't send passwords via email either. It's slightly more secure to email password reset links instead.

The real issue is not that someone might get Granny's forum password, but that Granny is statistically likely to have used that same password for her banking website. And we can't have that stolen.

share|improve this answer
    
"I've just purchased one for a personal website of mine for less than 15 euros for two years" Where? –  Zurechtweiser Jun 12 '13 at 23:25
1  
@Zurechtweiser Comodo, via my registrar, namecheap.com. It cost me $17.90 US for a two-year cert. –  Xander Jun 12 '13 at 23:28
    
I wrote "granny with no money." you wrote "but that Granny is statistically likely to have used that same password for her banking website". Your statement makes no sense. –  Zurechtweiser Jun 14 '13 at 22:57
1  
@Zurechtweiser The point is, you have to protect your users. All of them. The fact that one (or many) of them may not have much money, and that your site doesn't directly deal with their money is completely irrelevant. It's just an excuse for running a website irresponsibly, not a reasonable argument. –  Xander Jun 14 '13 at 23:08
    
It is pretty relevant as ssl slows a network down aswell as it raises exceptions in some browsers. In firefox a totally legitimate thwate certificate is shown as a certificate for an "unknown company". Without the certificate it wouldn't have even shown the message. People are more likely to not visit the site after that message than having been presented with no message at all. As even ssl-protected sites can be easily observed with Firesheep I see almost no use in using this protection at all. –  Zurechtweiser Jun 14 '13 at 23:56
add comment

Spilling the session token over an insecure channel, such as HTTP, is a violation of OWASP a9 and can be used to compromise an authenticated session (Firesheep). The password, and every request that contains a session token must be transmitted over HTTPS.

If your web application uses authentication, HTTPS is mandatory.

share|improve this answer
2  
"If your web application uses authentication, HTTPS is mandatory." I'll never get bored of hearing your answers/comments about HTTPS. +1 –  Adnan Jun 12 '13 at 23:23
3  
Mandatory as in use HTTP go to jail? Will OWASP take away my library card? –  this.josh Jun 13 '13 at 6:23
1  
Depending on the use of your website, at best you will have informed users not using it because of shoddy security practices. At worst, it might make you liable for damages far beyond a lifetime's SSL cert renewal costs. (if you also take credit cards You could be on the hook for a lot of lost money and fines.) –  Rod MacPherson Jun 13 '13 at 23:27
    
@this.josh Rod has a good point. Depending on your application it could be against the law. More importantly by not doing this you look like a very weak target that doesn't give a damn about even the most basic steps to protect your users. –  Rook Jun 14 '13 at 0:32
add comment

Cost is relative, good certificates aren't cheap, and perhaps 'good enough' certificates aren't very pricey...but as to the password question, IMO, you should NEVER email someone their password - you shouldn't be able to Any online service that was able to email me my forgotten password I cancel my account and move on; had to do it several times. Shows a fundamental lack of security awareness, especially if they are also holding you CC and/or other personal information.

If they can email you the password, they are not storing it correctly.

share|improve this answer
    
Are there ways to use php frameworks that do solve those security issues for you? –  Zurechtweiser Jun 13 '13 at 0:06
1  
There's no significant technical difference in the performance of an expensive cert vs. an inexpensive cert. This has been comprehensively discussed on this site in the past. –  Xander Jun 13 '13 at 0:13
1  
@Zurechtweiser: 'bolt-on' solutions don't solve security problems. Rely on a framework to guide you to creating more structured applications and reduce the amount of programming effort you need to do - you should never assume they will fix your problems for you / that you don't need to understand how they work in s much detail as your own code. –  symcbean Jun 13 '13 at 9:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.