2

I'm sort of confused about security on some sites. Here on stackexchange.com, for example, seem to have no security normaly, but as you log in or create an account, it uses keyexchange and an encrypted connection. However, on the site magicworld.se I noted that they use no encryption at all. Does this mean that a hacker with ease can find my password? Wouldn't that imply, that if I had used the same password on another website with security, a hacker could login to my account there?

2
  • 2
    If a bad guy can intercept (has access to) the traffic between you and the server, then he will see your password in plaintext, that is correct. You should be using a password manager and generate seperate passwords for each website. Then at least you don't risk to get totally compromised if indeed somebody manages to spy on your traffic. Or just avoid websites which still don't use https in 2016...
    – Blub
    Mar 29, 2016 at 13:42
  • Don't use the same password on multiple sites, for the reasons you've identified. Your identify is then only as safe as your weakest account. Mar 29, 2016 at 16:10

1 Answer 1

2

Technically, they don't have "no security" - they are just lacking in encryption for connections. It's entirely possible that once the data reaches the server, it is stored in bcrypt hashed password fields, with full protection against XSS, CSRF and any other attack you can think of.

A lack of HTTPS connection just means that the connection between your browser and the server is not encrypted - as @Blub says, this could potentially allow someone with access to intercept or monitor your traffic to steal your password, or to change what you see (by intercepting the traffic from the server to your browser). This isn't ideal, especially nowadays, but for some systems has been considered an acceptable risk - there are probably limited uses for intercepting sites which don't have login areas, for example.

For sites with login pages, though, it's considered a more serious risk, since it can be trivial to intercept some kinds of traffic, especially when using open wifi points.

For StackExchange sites, you should be able to access them over HTTPS by adding the https:// protocol string to the start of the URL - this isn't default due to various issues with subdomains (Meta sites).

And, yes, if you use the same password on multiple sites, a hacker capturing your credentials would allow access to all of them. Don't use the same password everywhere!

2
  • Thank you. How can a hacker have access to the traffic, apart from open wifi? I am very new to computer science, so this might be a stupid question, but it is relevant in the cryptography I'm learning, since they often use ADV and assume that a bad guy has acces, but they do not explain how that happens.
    – G H Hardy
    Mar 29, 2016 at 19:26
  • Many different ways: they might gain access to a cache server for the site, which has stored your data on the way through. They might be able to divert traffic to a fake site, with no way to verify (if using HTTPS, it's theoretically possible to check the certificate, even if few people do). Don't forget that data might pass through many servers between you and the server hosting the site you're using - all of which could see the data.
    – Matthew
    Mar 29, 2016 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .