1

I've noticed one of the sites I am looking to join does not use SSL even when logging in.

I am curious what security implications, besides plain-text password extraction, exist with this bad practice? I am assuming that a MITM could be set up intercepting all of the plain-text information and could use that against others (such as ip, login info, etc).

I am curious what is the recommended approach to using sites like this? I was thinking a VPN and random username/password to accomplish this.

Would it be best to not even use the site? Although, there are many sites out there that are like this, which is scary.

EDIT: I should mention that when I say "worry" I mean in the context of just creating an account, logging in, browsing, and commenting messages on the site. I do not mean anything that could cause problems i.e., bank account info, or any other "sensitive information" (besides passwords).

EDIT2: Second part of this question for those who might be in this situation. If one has already registered to a site that has no SSL at all, what steps should one take to get rid of their information off of the site and/or protect themselves?

EDIT 3: Does the problems with SSL appear with SSL on login only, or does the site need to fully have SSL? There are many sites with SSL only on login, and from what is being said here it seems that the entire site should use SSL.

Improve this question
4
  • You should be aware that even with SSL, any network eavesdropper will see what websites your IP address is connecting to (typically server's hostname is sent in plaintext when establishing connection to ensure you get the right certificate) as well as how much information is exchanged. It is always good practice to never re-use passwords (or only re-use passwords for weak things you have no worry about being compromised like an account in a forum you barely use).
    – dr jimbob
    Dec 26, 2016 at 23:15
  • I'm surprised that it would be sent via plain-text, instead of also encrypted as part of the request? I am not really sure how it all works with certificates and that jazz though, so any information is appreciated. VPN should fix this problem, correct?
    – XaolingBao
    Dec 26, 2016 at 23:59
  • Your IP address and the server's IP address has to be in plaintext, sort of like how using postal system to converse with a pen pal (sending messages back and forth), their address has to be readable by everyone if it is to be delivered correctly (and your return address has to be accurate for them to send a response). (Yes you could send encrypted messages to a middleman who decrypts and sends to their recipient, but still IPs are there). When multiple servers exist on same IP address, you need to say what domain you want in ClientHello to set up encryption with the correct certificate.
    – dr jimbob
    Dec 27, 2016 at 6:39
  • Related: What is the benefit of forcing a site to load over SSL (HTTPS)? on Webmasters.
    – user
    Dec 28, 2016 at 10:37

3 Answers 3

Reset to default
2

MITM is the main issue, anything that is capable of monitoring your transmissions can capture/replay data - and of course dynamically change data - with impunity.

This is really bad practice for any site and you should let them know immediately.

Ideally, you should not use the site. If you feel you have to, make absolutely certain you do not give any data that might be used for identity theft, phishing or similar attacks.

I always find it really remarkable that, in this age of cyber attacks, that some site owners and some users still seem to have absolutely know clue that this is an issue.

If, as implied, this is just a forum site, I would still ensure that I didn't use my "normal" email address and certainly I wouldn't reuse a password. Also be aware that it is possible (though I admit not that likely) that someone could easily impersonate you if they wanted to.

There is no excuse for this - even cheap hosting sites will generally offer a cheap shared SSL/TLS option which is enough to stop all but the most determined and resourceful attackers.

For Update 2: Immediately remove any personally identifiable data and ensure you have no financial data registered. If you did register financial details, report the site to your bank/credit-card company immediately - it is likely that the site would loose their ability to sell.

If you reused an email address, try to change it as quickly as possible. Many mail services allow [email protected] or whatever, e.g. you can add a +something after your name though not all registration functions will accept a plus symbol (though they should as it is part of the RFC). If you can't do that, try creating a free mail account (e.g. Gmail, Outlook.com, etc) and use that instead.

If you reused a password, change the reused password on all other sites straight away & turn on two-factor-authentication wherever possible to help prevent identity theft.

If you shared your physical location or other personal details, you should just monitor the situation - after removing the details - it is actually very unlikely that anyone will have been able to do anything so don't panic, just be sensible. Also, even if you only share your City or county take note if you have an unusual name for your locality. Maybe think again about sharing in that case.

Update 3: Having SSL on the login input page, the login transactions and any user profile pages is the absolute minimum for a site that has a login. You must also have it on any secure transactions of course and that includes any session interactions. It is all too easy to make a configuration mistake. Also, it is easy to end up with other pages over time that should be protected. There are also some standards that require all interactions to be over TLS. So you can see that it is by far the best practice to simply make everything TLS secured and have done with it.

Improve this answer
12
  • Thanks for the information. The funny thing is this is a very popular site, and the owners were saying that SSL would affect their ads, so they wont use SSL. There are many users who aren't happy with this, and it's been like this for years. As for information, /I would be using dummy accounts, passwords, and use a proxy/VPN, but yes, I am a bit sketched out. I also found another site that is like this, and it's a shame that sites don't use SSL....
    – XaolingBao
    Dec 26, 2016 at 22:30
  • 1
    There is absolutely no excuse whatsoever and any advertising network that can't cope with an SSL/TLS host site is putting customers in real danger. There is a massive increase in rogue "malvertising" even on the best of advertising networks - such that I am now recommending people to block all adverts and we are doing this at the enterprise scale. Without SSL, the risks will be even higher I'm sure. The lack of SSL is simple lazy thinking from the vendor.
    – Julian Knight
    Dec 26, 2016 at 22:39
  • Thank you Julian, is there anywhere these sites can be reported to some authority such as "Plain-Text offenders?" I don't want to be the snitch, but just curious? There excuse for the ads were that some ads wont work and that ad revenue would be lost of some crap, and when asked about SSL login there was talk about it, but was never done. I'm not sure if I should post the topic(s) that was created when asking about SSL for the site.
    – XaolingBao
    Dec 26, 2016 at 22:43
  • No problem. There is no law against this so nowhere you can report I'm afraid unless they are doing something like taking personally identifiable data - more likely an issue if they are based in the EU anyway where privacy laws are stricter. In that case, you could report them to the Data Protection commision. The advertising excuse really is rubbish, they will get better adverising revenues by having more users who trust the site. You could try taking to Twitter, I've found the exposure there can sometimes get people moving,
    – Julian Knight
    Dec 26, 2016 at 22:49
  • Thanks for the information. I wasn't thinking of the law, but sites, as I said, such as "PTO" that will post the information and I think contact companies about this issue. I also updated the OP to ask what one should do in case they already have registered to a site such as this (just for people in the future, in case they did this by accident and are searching this site for answers).
    – XaolingBao
    Dec 26, 2016 at 22:50
1

Malware injection

A separate risk of non-secure channels (such as http) is that an attacker can modify the data you receive from a source that you trust.

Without https, a third party can do anything that the legitimate web site owner could do to you, but reasonably would not (at least not intentionally). They may modify any downloaded executables to include malware. They can inject code in the web page that exploits a vulnerability in your browser - for example, your copy of a popular news website html may contain a link to an additional Adobe Flash object with an exploit and a targeted payload.

Improve this answer
9
  • Nice answer, would it matter who is compromised, or the 3rd party can modify data regardless if you, or the server is compromised?
    – XaolingBao
    Dec 27, 2016 at 17:11
  • 1
    A third party can modify data in transit (or possibly MITM) even if the server is secure and your computer is secure. Cooperation or attacking any single system or channel "on the way" between you and the server would be sufficient - your home router, your ISP, physical attack on the cable between you and your ISP, some transit network, the ISP of the server (e.g. with gov't cooperation), a BGP hijack of the network route, DNS spoofing - there are many possible ways how anyone can intercept and modify http data in transit, in HTTP there is no guarantee that what they send is what you receive.
    – Peteris
    Dec 27, 2016 at 17:36
  • Thanks, didn't realize how many different paths it all takes. Now what forms of "data" can be affected? Is it just if you are uploading/downloading things, or even browsing the webpage has the possibility of having issues? I would assume that if you can change anything, then even the source being sent to your browser could be modified then?
    – XaolingBao
    Dec 27, 2016 at 17:40
  • @XaolingBao everything - modifying the text/html that you see, inserting/changing advertisements for profit purposes, adding/changing new javascript or plugin (flash/silverlight/java/etc) code. For example, they could add javascript that detects that the page/tab is inactive for a few minutes and then change the original page content to something that looks like gmail login page, hoping that you might enter your credentials when returning to that browser tab.
    – Peteris
    Dec 27, 2016 at 18:14
  • Thanks for the information. Does this happen if the entire site doesn't have SSL,. but login does? I would assume all sites would waznt SSL 100%, but a lot of sites only use SSL for login.
    – XaolingBao
    Dec 28, 2016 at 3:02
0

Beside passwords (and other sentitives informations like credit cards), what to worry for a website without https?

From the website owner point of view

  • Ads may be injected to webpages

  • If any personal information is handled, it may be illegal: in most countries, there is an obligation of protection for such data (Data protection laws)

From visitors point of view

  • You can't enter any personal information without be sure it will not be intercepted and stored by a malicious third party.

  • You should assume any url you visits will be recorded and linked to your IP address. If you enter an email at any time (even in another http website), you should assume all your browsing history can be linked to you.

Improve this answer
5
  • I'm not sure what your last bullet point is trying to convey by mentioning entering an email address and browser history.
    – XaolingBao
    Dec 27, 2016 at 17:04
  • Without https, the URLs are not encrypted. If you visits a website like example.com!how-to-deal-with-cancer then another website that asks your email, then anybody on the network can know that you (by your email) have visited the website about cancer.
    – Tom
    Dec 27, 2016 at 18:32
  • Thanks. The network isn't a big deal since it's mine, so I doubt there is any issue about my sites popping up. You made it seem as if your entire browser history would be available to a site without SSL.
    – XaolingBao
    Dec 28, 2016 at 3:14
  • Yours? No. The network include anything between you and the website: your home network, your ISP network, some transit network, and the network of the website. And some routers on these networks already inject ads, how knows if they don't records things too?
    – Tom
    Dec 28, 2016 at 14:39
  • And no, the website can't know your browsing history, but your ISP know all your history of websites without https.
    – Tom
    Dec 28, 2016 at 14:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .