32

Most webpages from Stack Overflow use http even if you are logged in.

Isn't it a security issue?

Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent over http?

Edit

I found this great post by Troy Hunt that explains the security of Stack Overflow.

Improve this question
3
  • 1
    SE is slowly migrating towards SSL. But there are some technical issues, such as advertisements hosted on external servers, external images, wild card certificates being incompatible with the meta.*.stackexchange.com domains,...
    – CodesInChaos
    Commented Sep 9, 2014 at 17:28
  • 6
    It's covered in detail on Nick Craver's blog here: Stackoverflow.com: the road to SSL.
    – Xander
    Commented Sep 9, 2014 at 17:40
  • It's coming soon - "Expect Stack Overflow to go default https:// in the next few weeks. – Nick Craver♦"
    – stuartd
    Commented Feb 19, 2017 at 21:33

2 Answers 2

Reset to default
16

To answer your questions in order:

1) Mixed content. The typical StackExchange page combines content from a number of sources (ad servers, imgur, gravatar, etc.), and not all of these support HTTPS yet. Browsers react in varying ways to pages that contain a mix of HTTP and HTTPS content, but the most common is to refuse to load the insecure content, leaving you with a broken page.

2) Yes, it's a security issue. It's not as much of one as it could be, though, since the login pages use SSL.

3) Maybe. It depends on if StackExchange is using session fixation techniques to prevent session stealing or not.

Improve this answer
9
  • 1
    Isn't the login page using SSL irrelevant since a man in the middle attack could steal the authentication cookie on a page that doesn't use SSL? How would session fixation prevent that?
    – Abe Miessler
    Commented Sep 9, 2014 at 18:42
  • 2
    @AbeMiessler, Session fixation can have the effect of making cookie stealing less useful. For example, if the authentication cookie is tied to your IP address, stealing it won't help the attacker, except in the case that they're behind the same NAT router as you are.
    – Mark
    Commented Sep 9, 2014 at 19:52
  • 3
    @Mark: "except in the case that they're behind the same NAT router as you are" - But that's the case when cookie stealing is most likely to occur - you're on an unsecure public WiFi network. So this is no mitigation at all.
    – Kevin
    Commented Jul 16, 2016 at 18:18
  • 5
    @Mark "and not all of these support HTTPS yet" is this still the case?
    – Simon
    Commented Jul 22, 2016 at 15:16
  • 2
    Time to start boycotting Stackoverflow. Stackoverflow has plenty of time to modernise. Now with ISP evesdropping passed in both houses, we need to seriously look at webpages that don't care about user security and privacy.
    – Shiv
    Commented Mar 30, 2017 at 4:01
3

Just wanted to mention that it is there now: https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/

May 22, 2017

Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The activation of this is quite literally flipping a switch (feature flag), but getting to that point has taken years of work. As of now, HTTPS is the default on all Q&A websites.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .