2

I need to apply for a new passport, but my government's official website for submitting applications containing personally identifiable data does not use HTTPS — http://passport.gov.in/nri/Online.do

Normally, if a website is insecure and I don't need to use it, I simply won't use it or will find an alternative that is secure. In this case though, I'm at a loss — I need to apply for a new passport and I don't have an alternative because this is the government's only website. The form contains extremely sensitive & private information — pretty much my entire life history — and it would be a great loss if it were leaked.

How does one approach such a situation from a security perspective? Is petitioning my government to upgrade their security practices the only option?

P.S. Sending in a paper application is not an option, because the information needs to be sent to India somehow and the processing contractor will simply re-upload the data using the same insecure website. That is if they haven't rejected a paper application in the first place.

  • What browser do you use? IE11, Firefox, Chrome and Android past 4.4.2 are necessary. – Deer Hunter Mar 27 '16 at 18:16
7

Simply use the https version of this site which you can do by simply replacing the http:// in the URL with https://. It works and the site has also a valid certificate. And I don't know how you got to this site but if I search in google for 'Online NRI Passport Application' I actually get the https site as first result.

  • 1
    May be an issue of the OP's browser. For old Androids, and a host of other browsers, the server terminates connection forcefully. See ssllabs.com/ssltest/analyze.html?d=passport.gov.in – Deer Hunter Mar 27 '16 at 18:14
  • 1
    Oh wow, thanks! The http version was linked to from the Consulate's website. I instinctively tried the https version, but I kept getting the http version. I just tried now in Chrome and FF and it does work! Chrome gives me a warning "This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private." and "Your connection to passport.gov.in is encrypted with obsolete cryptography.", but hey, something is probably better than nothing! – jkq Mar 27 '16 at 18:24
2

Well, the SSLLabs results are extremely interesting:

  • TLS 1.2 is the only supported secure version, which is excellent
  • TLS_RSA_WITH_AES_256_GCM_SHA384 cipher suite is supported, which is excellent
  • An RC4 cipher suite is supported, which is horrific

My advice would be to start with Firefox, add the HTTPS Everywhere extension, and once it's installed, check the "Block all HTTP requests" option.

This will do the best job of preventing normal HTTP requests from happening that I'm aware of; it's possible parts of the site will not work, so you may need a separate browser session (in a different browser) on the HTTP site to look up their instructions. It's also possible critical parts of the site require HTTP, such as servers serving javascript, but you won't know until you try.

For the highest level of security available, in Firefox go to about:config, filter on "ssl3", and disable everything except the GCM cipher.

RC4 should already be disabled, so that helps, at least.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.