33

Most webpages from Stack Overflow use http even if you are logged in.

Isn't it a security issue?

Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent over http?

Edit

I found this great post by Troy Hunt that explains the security of Stack Overflow.

  • 1
    SE is slowly migrating towards SSL. But there are some technical issues, such as advertisements hosted on external servers, external images, wild card certificates being incompatible with the meta.*.stackexchange.com domains,... – CodesInChaos Sep 9 '14 at 17:28
  • 6
    It's covered in detail on Nick Craver's blog here: Stackoverflow.com: the road to SSL. – Xander Sep 9 '14 at 17:40
  • It's coming soon - "Expect Stack Overflow to go default https:// in the next few weeks. – Nick Craver♦" – stuartd Feb 19 '17 at 21:33
16

To answer your questions in order:

1) Mixed content. The typical StackExchange page combines content from a number of sources (ad servers, imgur, gravatar, etc.), and not all of these support HTTPS yet. Browsers react in varying ways to pages that contain a mix of HTTP and HTTPS content, but the most common is to refuse to load the insecure content, leaving you with a broken page.

2) Yes, it's a security issue. It's not as much of one as it could be, though, since the login pages use SSL.

3) Maybe. It depends on if StackExchange is using session fixation techniques to prevent session stealing or not.

  • 1
    Isn't the login page using SSL irrelevant since a man in the middle attack could steal the authentication cookie on a page that doesn't use SSL? How would session fixation prevent that? – Abe Miessler Sep 9 '14 at 18:42
  • 2
    @AbeMiessler, Session fixation can have the effect of making cookie stealing less useful. For example, if the authentication cookie is tied to your IP address, stealing it won't help the attacker, except in the case that they're behind the same NAT router as you are. – Mark Sep 9 '14 at 19:52
  • 3
    @Mark: "except in the case that they're behind the same NAT router as you are" - But that's the case when cookie stealing is most likely to occur - you're on an unsecure public WiFi network. So this is no mitigation at all. – Kevin Jul 16 '16 at 18:18
  • 5
    @Mark "and not all of these support HTTPS yet" is this still the case? – Simon Jul 22 '16 at 15:16
  • 2
    Time to start boycotting Stackoverflow. Stackoverflow has plenty of time to modernise. Now with ISP evesdropping passed in both houses, we need to seriously look at webpages that don't care about user security and privacy. – Shiv Mar 30 '17 at 4:01
3

Just wanted to mention that it is there now: https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/

May 22, 2017

Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The activation of this is quite literally flipping a switch (feature flag), but getting to that point has taken years of work. As of now, HTTPS is the default on all Q&A websites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.