4

So I use the Three network in the UK to access the Internet on my phone. Recently, I noticed when going to mobile.three.co.uk to access services which also includes information about my email address, home address, my PIN for accessing security settings, etc. (i.e. my personal and security information), that the website was not encrypted! This meant all my personal information and sensitive PIN number and other security information was being transmitted over the internet in the clear, which is very, very bad for security!

Am I overreacting or is this actually not very good security practice?

You can see screenshots I took:

https://www.dropbox.com/s/oxtxznakaf2scr3/1.PNG?dl=0

https://www.dropbox.com/s/6nsp0k9l32y9m9a/2.PNG?dl=0

Now, on that page in the picture above, I have to enter an access PIN, after which I can access pages displaying my home address, email address, international settings, security questions, etc. - but this page itself also uses HTTP not HTTPS! (However, any page to do with financial stuff like direct debit details is encrypted and shows up as HTTPS, but surely pages with personal information should also be encrypted?)

Improve this question
2
  • it could use https under the hood to actually send your details. that's not as good as top-down https, due to poor/no authentication, but at least your private details are not floating around cyberspace in the clear. not saying that's the case, just that it's possible. if the page showing your details is in the clear, that's a problem.
    – dandavis
    Commented Jun 9, 2017 at 9:02
  • Another possibility would be that the access PIN you're giving may be sent over plain-text in HTTP, but before the server gives you your details, it may be redirecting the phone browser to a secure page over HTTPS via a 302 HTTP message. As you're aware, once HTTPS is established, any data that flows in that channel will be secure and eavesdropping would be impractical. A better way to check it is using a packet capture tool. I'm not aware of any mobile app which captures packets, but you can try accessing the page from a PC while running the tool (ex. wireshark)
    – commanderdileep
    Commented Jul 10, 2017 at 10:32

2 Answers 2

Reset to default
2

It is not good practice, for sure.

As suggested, they may be using HTTPS to send the form but the overhead of using HTTPS for everything in the site is minimal nowadays so it seems unlikely. Moreover, by not using HTTPS in the main website to login anyone with MiM capabilities can know that you are on that website (they may not be able to get the credentials if HTTPS is used though).

So in short, it is not good, bad practice and insecure besides diminishing your privacy.

Improve this answer
2

The answer by @Guille is absolutely correct, however there is one aspect that it might not take into account and specific to mobile networks.

The screenshots posted show that you are connected to Three via 4G which is encrypted and is very possibly never leaving to the internet and is handled directly by Three via an internal network (4G is considered secure encryption as far as I am aware at this point) therefore the traffic will only be unencrypted in transit in Three's internal networks. This scenario would be very similar to how many companies transfer all this data using HTTP, and only encrypt as it leaves their networks at, for example, load balancers or reverse proxies. In this case it is never leaving the "trusted" network.

One way to test this is to turn on WiFi and check this is still handled the same way.

I would certainly agree that HTTPS would be best practice, but it may not be as bad as it initially appears.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .