This question already has an answer here:

I've been using Zenfolio for a while now (a site for Photographers to create portfolios of their work). I noticed that when I use their password-protected folders function, when I go to a page that is password protected, the connection is not secure, so Chrome complains (and I assume that Firefox and IE are the same, in that they will warn the user the connection is not secure despite being asked for a password). Now, none of my stuff is confidential that's being password protected (I'm just trying to keep it from prying eyes as most of the password-protected stuff is family pictures that the public doesn't really need access to--but if they had access, it's not like they can do much with it...)

They do use HTTPS/TLS secured connections when I'm working/developing my site (making changes to the site, uploading photos, etc).

I have a basic understanding of what HTTPS/TLS does in that it ensures that the connection between the server and the client is secure, so I'm assuming that Zenfolio uses plaintext authentication, unless somewhere on the client side the password is being hashed before being sent back to the server...? I haven't looked at any of their page code to see if it does this or not...

So my question is this: should I be concerned about this lack of the use of HTTPS/TLS connections when getting the password from the client (user)? Most other services (SquareSpace) use HTTPS or TLS when doing such activities.

marked as duplicate by tim, Steffen Ullrich, Rory Alsop May 28 '17 at 8:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from crypto.stackexchange.com May 27 '17 at 10:27

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • What if you re-use passwords across secure and non-secure sites? – SEJPM May 27 '17 at 6:58

These days, you should always use HTTPS (TLS). Not just because of securing the data transmitted. But also because this is only the one way how you can be sure the server you are connecting to is really the server you want to connect.

Back to your question. If anybody will be able to capture the password, even hashed on client side, does it really matter if the password is plain text or hashed? It can be used to login the service in both ways. There is only one difference, it would probably not be useful for different sites.

Also, please note that if the Basic HTTP authentication is used the data are transferred as Base64 encoded string "username:password". Base64 is just encoding and can be re-encoded back very simple.

Not the answer you're looking for? Browse other questions tagged or ask your own question.