1

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, twitch.tv.

When you log in to this site, security.stackexchange, it does say that it uses https, but when I'm just browsing the site it says it doesn't use https. Is this secure? If it is, how? Aren't headers and cookies (like session id) and all data in my requests unencrypted and vulnerable to attackers every time I request a new page?

  • 3
    Secure against what? There's no such thing as “secure”, only security against a particular class of threats. – Gilles Apr 25 '15 at 23:03
  • Well, I'm not very knowledgable about different kinds of threats, but for example a man in the middle threat? – Mattias Apr 25 '15 at 23:14
  • I agree with @Gilles. Something you should know: Security is all about context. – Rahil Arora Apr 26 '15 at 1:22
  • You can access the sites via HTTPS if you want. It should be default but it's there if you want. Try security.stackexchange.com – Neil Smithline Apr 26 '15 at 4:02
  • Against getting malware? Probably not. And anyone doing a packet sniff can see cleartext of what you're reading, and your posts, hmm, they can also see your posts after you've saved them as well... nevermind. – Fiasco Labs Apr 26 '15 at 5:06
2

I think we should keep things in perspective here. Is visiting a news site over HTTP non-secure or a security issue?

Visiting a site over HTTP is fine as long as sensitive information is not transmitted over HTTP.

Is visiting this site over HTTP an issue? It might be! If you are authenticated (logged in), the session cookie is transmitted in each request. This could be a problem in public areas.

It is less likely when you're doing this from home. I recommend using a VPN connection in public areas.

In addition you could use an extension for your browser to for to use HTTPS rather than HTTP, it's called HTTPS Everywhere.

  • I realized through testing that the session id cookie is the same when transmitted through http as when transmitted through https on stackoverflow.com (according to my my request headers in chrome developer tools). Is it encrypted or not? And why do not sites like stackoverflow use https by default? From what I can tell twitch.tv doesn't use https at all (except for maybe login-authentication). This confuses me, since I feel like huge websites like these should have the best possible security. – Mattias Apr 26 '15 at 7:08
  • No, it is not encrypted and even if it was it doesn't matter since it is possible to capture it using a man in the middle attack. Your feeling is right but in the real world it isn't always what you expect and/or want it to be. Welcome to our world! – Jeroen Apr 26 '15 at 7:43
  • What do you mean with "even if it was it doesn't matter"? Why doesn't it matter? – Mattias Apr 26 '15 at 8:10
  • 1
    +1 for the recommendation of HTTPS Everywhere I warmly recommend too. It is a plugin made by EFF, available for all major browsers, designed to switch on HTTPS on sites using HTTP by default even while they have HTTPS access available. – WhiteWinterWolf Apr 26 '15 at 8:53
  • @Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS). – apsillers Apr 27 '15 at 12:55
1

Yes, it's unsecure. You send your requests and all data in plain text. I am not sure about cookies, but other data is not safe. If somebody make a MITM (Man In The Middle) to you, he can see what you send and what you receive. Also and your ISP ( Internet Service Provider) can see your data which you send to some http web site.

0

In addition to the above answers, if you want to see for yourself what can be revealed to an attacker if he can intercept HTTP traffic:

Use Wireshark to capture from the interface that your connection uses, select 'http' as filer and start capturing. Then browser HTTP sites from your browser. You will be able to see in real-time in Wireshark what kind of information an attacker has access to, given the above situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.