Come on guys – it’s almost 2017, and Stack Overflow still runs in plain HTTP mode by default (like all of the Stack Exchange sites, BTW). By doing so, Stack Overflow exposes a set of security issues which put sensitive user information at risk.
(I understand that the issue of SSL on Stack Overflow has been discussed plenty of times. However, this post is about enforcing HTTPS site-wide or at least in a few sensitive areas.)
I would really expect a site like Stack Overflow to enforce HTTPS with HSTS. However, if you don’t enforce HTTPS site-wide, you should at least keep the following in mind:
Loading pages with potentially confidential content such as profile pages should only be possible via HTTPS.
Even more so: Write requests modifying user profiles and other sensitive data should by all means enforce HTTPS.
Authentication tokens (i.e. session cookies) which are also used to make sure the UA is allowed to make modifications should be HTTPS-only, hence not be transmitted on bare HTTP requests.
If you decide to have only certain areas protected, rather than site-wide HTTPS (+ HSTS): Keep in mind that a man-in-the-middle can deliver a forged version of Stack Overflow via HTTP, e.g. exchange the link to the login page with a fake one, thus rendering all further encryption more or less pointless.
I know that I can switch to the HTTPS version of Stack Overflow anytime. But I don’t always remember to do so. Of course, there are extensions such as HTTPS everywhere. But (a) they don’t work on all devices and (b) only few users have them installed.
So, dear Stack Overflow team, beside of creating all the wacky features that make us puke rainbows – please, at least enforce SSL where sensitive information is handled. And, don’t transmit privileged cookies via plain HTTP.
If that’s not possible in the near future, could you please explain why, and lay out a road map when we can expect it to be implemented?
For further reference:
- https://www.mashable.com/2011/05/31/https-web-security
- https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
P.S. the SSL tag description says that “HTTPS (SSL) is not officially supported”. Seriously?!