0

So I am using Zenfolio and I noticed that their password-protected pages feature does not utilize client-side SSL/TLS when asking a visitor to enter the password to visit the page/gallery.

Should I be concerned about this? Nothing that is being password protected is confidential, I just want to keep some things out of public view if possible (but it's not like if someone gets their hands on the photos that they are going to be able to do much with them anyway). Should I be concerned that there is no client-side SSL/TLS or not?

My Chrome browser warns me that the content entered on the page (ie. the password) is not encrypted. From my knowledge of security, I believe this should be a secure connection via SSL/TLS, and the "padlock" should show up in the browser as a result.

How much of a concern is this?

Improve this question
1
  • 1
    Are you certain that when the password is sumited, it's not submitted to an https URL? It's certainly possible for the page that prompts for the password to be http, and the URL where the username/password itself is https. It's still not particularly great, but it's much better than plaintext submission.
    – Steve Sether
    Commented May 23, 2017 at 18:36

2 Answers 2

Reset to default
1

I'm not entirely clear whether you're the user or administrator, so I'll answer for both.

As an administrator: I'd consider it a big concern, primarily because of password reuse: people will use the same password for this that they use for Facebook and their bank, and then be upset when their account information is stolen. I'd suggest using a service like Let's Encrypt to get free certificates.

But as a user, it's not really a big deal: simply use a throw-away password for the site and remember that any material is sniff-able, and that you have no guarantee of confidentiality or integrity.

Improve this answer
0

There are two things that TLS/SSL gives you: privacy and authentication.

Privacy. Over a non-SSL channel, your password will not be private, nor will any of the content you submit to the site. So make sure none of that is valuable.

Authentication. Over a non-SSL channel, you could request a page from www.MyArtSite.com but get content served from www.HackersDelight.com. If the site is malicious, it could attempt to exploit your browser to do something nefarius, e.g. download malware, execute attacks against other sites, etc.

If you want to be very safe,

  1. Use a password that you don't use anywhere else
  2. Only upload content that wouldn't trouble you if it were made public
  3. Use a incognito/private session, so that your browser won't contain any persistent cookies from other sites. This will protect you from CSRF.
  4. As always, make sure your O/S and anti-virus are up to date and fully patched.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .