Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 17 Aug 2013 11:42:04 +0800
From: Pavel Labushev <>
Subject: Re: HTTPS (was: rubygems insecure download (and
 other problems))

On Thu, 15 Aug 2013 10:38:09 +0400 wrote:

> On 14-Aug-2013 14:59:12 -0600, Kurt Seifried wrote:
>  > everyone should be enabling HTTPS where possible,
> Very dangerous mistake. HTTPS should be used only for non-anonymous
> access, otherwise plain HTTP is preferred. In any case, let the users
> choose whether they want to use it.

Well, there's a problem with HTTP -> HTTPS transition if it happens
during or after user authentication: if a login form resides on a page
obtained through HTTP, there's a opportunity for an attacker to steal
users' credentials by tampering the page's content during MitM before
the transition occurs. Of course you can redirect users to a separate
login page over HTTPS, but:
- IMHO, if they get used to HTTP and the lack of HTTPS indication
during their anonymous experience, then the chances they will check the
bar before filling the form may be lower than if they would have been
using HTTPS by default.
- Some people may consider it much less ergonomic and somewhat
contrary to the original look and feel, especially for the Pjax-based

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.