1

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, twitch.tv.

When you log in to this site, security.stackexchange, it does say that it uses https, but when I'm just browsing the site it says it doesn't use https. Is this secure? If it is, how? Aren't headers and cookies (like session id) and all data in my requests unencrypted and vulnerable to attackers every time I request a new page?

Improve this question
5
  • 3
    Secure against what? There's no such thing as “secure”, only security against a particular class of threats.
    – Gilles 'SO- stop being evil'
    Apr 25, 2015 at 23:03
  • Well, I'm not very knowledgable about different kinds of threats, but for example a man in the middle threat?
    – Mattias
    Apr 25, 2015 at 23:14
  • I agree with @Gilles. Something you should know: Security is all about context.
    – Rahil Arora
    Apr 26, 2015 at 1:22
  • You can access the sites via HTTPS if you want. It should be default but it's there if you want. Try security.stackexchange.com
    – Neil Smithline
    Apr 26, 2015 at 4:02
  • Against getting malware? Probably not. And anyone doing a packet sniff can see cleartext of what you're reading, and your posts, hmm, they can also see your posts after you've saved them as well... nevermind.
    – Fiasco Labs
    Apr 26, 2015 at 5:06

3 Answers 3

Reset to default
2

I think we should keep things in perspective here. Is visiting a news site over HTTP non-secure or a security issue?

Visiting a site over HTTP is fine as long as sensitive information is not transmitted over HTTP.

Is visiting this site over HTTP an issue? It might be! If you are authenticated (logged in), the session cookie is transmitted in each request. This could be a problem in public areas.

It is less likely when you're doing this from home. I recommend using a VPN connection in public areas.

In addition you could use an extension for your browser to for to use HTTPS rather than HTTP, it's called HTTPS Everywhere.

Improve this answer
5
  • I realized through testing that the session id cookie is the same when transmitted through http as when transmitted through https on stackoverflow.com (according to my my request headers in chrome developer tools). Is it encrypted or not? And why do not sites like stackoverflow use https by default? From what I can tell twitch.tv doesn't use https at all (except for maybe login-authentication). This confuses me, since I feel like huge websites like these should have the best possible security.
    – Mattias
    Apr 26, 2015 at 7:08
  • No, it is not encrypted and even if it was it doesn't matter since it is possible to capture it using a man in the middle attack. Your feeling is right but in the real world it isn't always what you expect and/or want it to be. Welcome to our world!
    – Jeroen
    Apr 26, 2015 at 7:43
  • What do you mean with "even if it was it doesn't matter"? Why doesn't it matter?
    – Mattias
    Apr 26, 2015 at 8:10
  • 1
    +1 for the recommendation of HTTPS Everywhere I warmly recommend too. It is a plugin made by EFF, available for all major browsers, designed to switch on HTTPS on sites using HTTP by default even while they have HTTPS access available.
    – WhiteWinterWolf
    Apr 26, 2015 at 8:53
  • @Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
    – apsillers
    Apr 27, 2015 at 12:55
1

Yes, it's unsecure. You send your requests and all data in plain text. I am not sure about cookies, but other data is not safe. If somebody make a MITM (Man In The Middle) to you, he can see what you send and what you receive. Also and your ISP ( Internet Service Provider) can see your data which you send to some http web site.

Improve this answer
0

In addition to the above answers, if you want to see for yourself what can be revealed to an attacker if he can intercept HTTP traffic:

Use Wireshark to capture from the interface that your connection uses, select 'http' as filer and start capturing. Then browser HTTP sites from your browser. You will be able to see in real-time in Wireshark what kind of information an attacker has access to, given the above situation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .