0

I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password page(http://login.sina.com.cn/forgot/index?entry=weibo) are not secure i.e not using HTTPS. Are these pages really secure? Am I missing something here?

closed as too broad by Adi, Xander, TildalWave, Gilles, NULLZ Nov 12 '13 at 2:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

No, such sites can eventually never be secure, since the information which is transfered can always be looked at and it can always be modified on it's travel or on the client side e.g. by malicious browser-add ons or any other malicious software running of the client.

This is particularly true, if the machine is a public "kiosk" mode operated terminal.

The above is true, regardless if authentication and/or encryption (confidentiality, integrity) is considered; none of this can be ensured without encrypting the communication.

Not the answer you're looking for? Browse other questions tagged or ask your own question.