1

I'm not using SSL encryption on my website. Which (correct if I'm wrong) means the data transmitted between users and the server can be sniffed as text, including passwords.

That is a big security threat, and I really can't install SSL for various other reasons. What can I do to increase security on my website? I though of only enabling social login, could you give me any other tips?

8
  • I'll ship this to different clients, and I can't make sure they all have SSL installed. There is no sensitive data, I just need to make sure the password to the admin area does not get intercepted.
    – sigmaxf
    Sep 22, 2016 at 4:30
  • You say only what you can't do but is is unknown what you can do. If you can't do SSL you maybe can't do digest authentication either because the client does not support it. And you probably can't do browser extensions/plugins too which might help. And maybe you can't do many other things too. Sep 22, 2016 at 4:34
  • 1
    Please refer to this stackoverflow.com/questions/2336678/…
    – Simon
    Sep 22, 2016 at 4:57
  • 3
    You clients do not have to install SSL separately, all wellknown browsers have it built in. So why do you think your clients cannot use SSL, it is a server side installation? Sep 22, 2016 at 6:50
  • 1
    What are these reasons you cannot get an SSL certificate?
    – user163495
    Oct 21, 2020 at 12:36

2 Answers 2

4

Setup an SSL certificate!

That's really the only answer here, especially if you are having people login. An attacker on the same network as your users can sniff everything, and an attacker who gets themselves in the middle can modify your response to remove any client-side protections you try to enable. I'd say that trying to secure a non-HTTPS connection is like trying to build a house without a foundation, but it's more like trying to build a sandcastle on a sandbar that is only exposed at low tide and covered in 10 feet of water at high tide. It's literally impossible.

These days you can easily get free certificates from let's encrypt. If your hosting company can't support SSL then it is time to move to a new one. Moving to a new company will be easier than trying to build privacy without HTTPS.

As a software provider though

If you are providing software and so are not responsible for deployment, and thus cannot provide certificates, then attempting to secure an HTTP connection is an even more dangerous approach. The problem is that if you say "We provide X safe guards so HTTPS is unnecessary!" your customers will believe you, and when your safeguards are inevitably breached you will be held liable. Don't do it. I have had to deploy a lot of 3rd party software systems so here are the sorts of things you want to do:

  1. Give suggestions for ways that they can add SSL via infrastructure, by doing things like putting a load balancer on top and using it for SSL termination. Most cloud providers can automatically provide SSL for their own load balancers.
  2. Provide a way for the end user to provide an SSL certificate which your software will use (do them a favor and make sure there is an option to automatically configure your software for automatic deployments)
  3. Provide some pre-baked options for automatic certificate management via Let's Encrypt/certbot.
-4

You can go for JavaScript/JQuery. They can encrypt the data before sending it over the network. Here are some options that you can consider.

  1. CryptoJS : - https://github.com/sytelus/CryptoJS
    Here is an example on how it can be used : - https://stackoverflow.com/questions/29584051/javascript-encrypt-form-before-sending-with-aes
  2. jCryption (Development Discontinued but code can be utilized) : - http://www.jcryption.org/
  3. Link Mentioned by @simon in the comments is also good : - https://stackoverflow.com/questions/2336678/login-without-https-how-to-secure
  4. You can also consider Hashing the password using javascript's MD5 or SHA libraries to hash the passwords and then send them over the network although if you are using this keep in mind to salt the hashes otherwise they will be as good as normal passwords.

You should also also keep in mind that this is not a replacement for SSL/TLS. TLS encrypts the whole data including the headers. Where as the Javascript can only encrypt the data in the body.
Hope this helps!

5
  • 5
    If an attacker can intercept the communication, he can very likely remove/alter the JavaScript as well. So JavaScript is not useful to secure a connection. Sep 22, 2016 at 6:47
  • No arguments there @martinstoeckli but one can still make javascript compulsory on the web app by making javascript submit the form. So if JS is disabled one won't be able to submit the form. More over the answer was more focused on mitigating sniffing/MITM.
    – 7h1n0b1
    Sep 22, 2016 at 7:15
  • On the infrastructure side, you can enable IPSec VPN and if your clients are limited (meaning not public in general), then you can ask them to authenticate with a VPN and send the unencrypted data over the wire. This does not fall in a development bucket normally though, it is mentioned just because you ask what else is possible.
    – yetdot
    Sep 22, 2016 at 11:42
  • 8
    I disagree with most of your suggestions. Client-side cryptography without HTTPS just doesn't work. And hashing the password before sending it does nothing to increase security. The correct answer to this question is really just "find a way to use SSL".
    – Luke Park
    Sep 22, 2016 at 12:09
  • There is no way for the server to know if a form was submitted "by javascript" or not, it's just data coming in an HTTP request. It's also easy for an attacker to get the javascript and determine what it sends to the server. Oct 22, 2020 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .