1

Come on guys – it’s almost 2017, and Stack Overflow still runs in plain HTTP mode by default (like all of the Stack Exchange sites, BTW). By doing so, Stack Overflow exposes a set of security issues which put sensitive user information at risk.

(I understand that the issue of SSL on Stack Overflow has been discussed plenty of times. However, this post is about enforcing HTTPS site-wide or at least in a few sensitive areas.)

I would really expect a site like Stack Overflow to enforce HTTPS with HSTS. However, if you don’t enforce HTTPS site-wide, you should at least keep the following in mind:

  • Loading pages with potentially confidential content such as profile pages should only be possible via HTTPS.

  • Even more so: Write requests modifying user profiles and other sensitive data should by all means enforce HTTPS.

  • Authentication tokens (i.e. session cookies) which are also used to make sure the UA is allowed to make modifications should be HTTPS-only, hence not be transmitted on bare HTTP requests.

  • If you decide to have only certain areas protected, rather than site-wide HTTPS (+ HSTS): Keep in mind that a man-in-the-middle can deliver a forged version of Stack Overflow via HTTP, e.g. exchange the link to the login page with a fake one, thus rendering all further encryption more or less pointless.


I know that I can switch to the HTTPS version of Stack Overflow anytime. But I don’t always remember to do so. Of course, there are extensions such as HTTPS everywhere. But (a) they don’t work on all devices and (b) only few users have them installed.

So, dear Stack Overflow team, beside of creating all the wacky features that make us puke rainbows – please, at least enforce SSL where sensitive information is handled. And, don’t transmit privileged cookies via plain HTTP.

If that’s not possible in the near future, could you please explain why, and lay out a road map when we can expect it to be implemented?

For further reference:


P.S. the SSL tag description says that “HTTPS (SSL) is not officially supported”. Seriously?!

12
  • 12
    Yes, seriously. We're working on full support but it's not there yet.
    – animuson StaffMod
    Dec 30, 2016 at 21:16
  • HTTPS Everywhere also breaks some things: meta.stackexchange.com/questions/284855/… Dec 30, 2016 at 21:23
  • 1
    @lxg Particularly, per-site Metas for the rest of the network don't work at all without exceptions because we can't have a meta.*.stackexchange.com certificate, so we're in the process of coordinating a switch to a *.meta.stackexchange.com model. Once that's done, the rest of it will mostly just fall into place.
    – animuson StaffMod
    Dec 30, 2016 at 21:28
  • 1
    I see. Why not use Let’s encrypt and generate a single-site certificate for each site? Or, couldn’t a a company such as SE become an intermediate CA of their own and issue certificates as they need?
    – lxg
    Dec 30, 2016 at 21:55
  • 3
    Issuing a new certificate for every single site that gets created on our network is not maintainable and quite the waste of time. That is why we're transitioning to an alternate domain structure model - so that we can put it all on one certificate.
    – animuson StaffMod
    Dec 30, 2016 at 23:30
  • 4
    @animuson: Maybe what we're looking for is some kind of status update. Yes, it's coming, and yes, there are difficulties, but the status update would at least head off questions like this. Somewhat.
    – Makoto
    Dec 31, 2016 at 1:37
  • A status update would be interesting and probably sate many inquiries, but the real problem is not just the lack of evidence of work being done. Rather, it is evidence of work being done on other new features—and in fact entirely new areas of the site—that seem trivial, irrelevant, and optional.
    – Cody Gray Mod
    Dec 31, 2016 at 7:39
  • 1
    FWIW you can automate certificate issuing with let's encrypt, that's what makes it so handy, but I guess a different domain structure also solves the problem.
    – ivarni
    Dec 31, 2016 at 9:43
  • What is "the UA"? "the user agent"? What does it really mean? Dec 31, 2016 at 14:02
  • 2
    I disagree with the "come on guys" tone of this question (as if this was something that's easy to do and SO's engineers are somehow neglecting it) but considering the last related post I can see is from 2015, it seems fair to ask for an update. So +1
    – Pekka
    Dec 31, 2016 at 14:34
  • 2
    @AlexanderO'Mara I think I fixed that particular issue github.com/EFForg/https-everywhere/pull/7518
    – Braiam
    Dec 31, 2016 at 16:47
  • @Pekka웃 ok, sorry if it sounded rude, it was intended to sound “tongue in cheek”.
    – lxg
    Jan 1, 2017 at 19:27

0

You must log in to answer this question.

Browse other questions tagged .