I'm not using SSL encryption on my website. Which (correct if I'm wrong) means the data transmitted between users and the server can be sniffed as text, including passwords.

That is a big security threat, and I really can't install SSL for various other reasons. What can I do to increase security on my website? I though of only enabling social login, could you give me any other tips?

  • I'll ship this to different clients, and I can't make sure they all have SSL installed. There is no sensitive data, I just need to make sure the password to the admin area does not get intercepted. – raphadko Sep 22 '16 at 4:30
  • You say only what you can't do but is is unknown what you can do. If you can't do SSL you maybe can't do digest authentication either because the client does not support it. And you probably can't do browser extensions/plugins too which might help. And maybe you can't do many other things too. – Steffen Ullrich Sep 22 '16 at 4:34
  • 1
    Please refer to this stackoverflow.com/questions/2336678/… – Simon Sep 22 '16 at 4:57
  • 3
    You clients do not have to install SSL separately, all wellknown browsers have it built in. So why do you think your clients cannot use SSL, it is a server side installation? – martinstoeckli Sep 22 '16 at 6:50
  • 1
    What are these reasons you cannot get an SSL certificate? – MechMK1 Oct 21 at 12:36

Setup an SSL certificate!

That's really the only answer here, especially if you are having people login. An attacker on the same network as your users can sniff everything, and an attacker who gets themselves in the middle can modify your response to remove any client-side protections you try to enable. I'd say that trying to secure a non-HTTPS connection is like trying to build a house without a foundation, but it's more like trying to build a sandcastle on a sandbar that is only exposed at low tide and covered in 10 feet of water at high tide. It's literally impossible.

These days you can easily get free certificates from let's encrypt. If your hosting company can't support SSL then it is time to move to a new one. Moving to a new company will be easier than trying to build privacy without HTTPS.

As a software provider though

If you are providing software and so are not responsible for deployment, and thus cannot provide certificates, then attempting to secure an HTTP connection is an even more dangerous approach. The problem is that if you say "We provide X safe guards so HTTPS is unnecessary!" your customers will believe you, and when your safeguards are inevitably breached you will be held liable. Don't do it. I have had to deploy a lot of 3rd party software systems so here are the sorts of things you want to do:

  1. Give suggestions for ways that they can add SSL via infrastructure, by doing things like putting a load balancer on top and using it for SSL termination. Most cloud providers can automatically provide SSL for their own load balancers.
  2. Provide a way for the end user to provide an SSL certificate which your software will use (do them a favor and make sure there is an option to automatically configure your software for automatic deployments)
  3. Provide some pre-baked options for automatic certificate management via Let's Encrypt/certbot.
| improve this answer | |

You can go for JavaScript/JQuery. They can encrypt the data before sending it over the network. Here are some options that you can consider.

  1. CryptoJS : - https://github.com/sytelus/CryptoJS
    Here is an example on how it can be used : - https://stackoverflow.com/questions/29584051/javascript-encrypt-form-before-sending-with-aes
  2. jCryption (Development Discontinued but code can be utilized) : - http://www.jcryption.org/
  3. Link Mentioned by @simon in the comments is also good : - https://stackoverflow.com/questions/2336678/login-without-https-how-to-secure
  4. You can also consider Hashing the password using javascript's MD5 or SHA libraries to hash the passwords and then send them over the network although if you are using this keep in mind to salt the hashes otherwise they will be as good as normal passwords.

You should also also keep in mind that this is not a replacement for SSL/TLS. TLS encrypts the whole data including the headers. Where as the Javascript can only encrypt the data in the body.
Hope this helps!

| improve this answer | |
  • 5
    If an attacker can intercept the communication, he can very likely remove/alter the JavaScript as well. So JavaScript is not useful to secure a connection. – martinstoeckli Sep 22 '16 at 6:47
  • No arguments there @martinstoeckli but one can still make javascript compulsory on the web app by making javascript submit the form. So if JS is disabled one won't be able to submit the form. More over the answer was more focused on mitigating sniffing/MITM. – 7h1n0b1 Sep 22 '16 at 7:15
  • On the infrastructure side, you can enable IPSec VPN and if your clients are limited (meaning not public in general), then you can ask them to authenticate with a VPN and send the unencrypted data over the wire. This does not fall in a development bucket normally though, it is mentioned just because you ask what else is possible. – yetdot Sep 22 '16 at 11:42
  • 8
    I disagree with most of your suggestions. Client-side cryptography without HTTPS just doesn't work. And hashing the password before sending it does nothing to increase security. The correct answer to this question is really just "find a way to use SSL". – Luke Park Sep 22 '16 at 12:09
  • There is no way for the server to know if a form was submitted "by javascript" or not, it's just data coming in an HTTP request. It's also easy for an attacker to get the javascript and determine what it sends to the server. – President James K. Polk Oct 22 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.