How secure

r2oo · Guest

Hi, before I use the service I just wanted some re-assurance on how secure & safe it is. I noticed that there is no H T T P S : / / in the title bar stating a secure connection.

Regards
Adam

Cupid · Joined: 09 Aug 2007 Posts: 7596 Location: Bristol, UK

The target of the 'Log in Now' button is an https link... which is all that is necessary to ensure that your credentials are sent securely... To confirm this, if you understand web programming, you can view the page source of this page in your browser.

The whole site is not accessed via https because then adverts could not be hosted... which is what helps to keep the main service free to all.

This is the code you are looking for:

Guest · Posted: Fri Jul 08, 2016 10:47 pm Post subject:

Unfortunately this isn't really true. Without HTTPS on the page that generates the form, an attacker in a MITM position could rewrite the form to send credentials elsewhere.

HTTPS is needed on both the form supplying the login page AND the destination page to have any measure of security.

Cupid · Joined: 09 Aug 2007 Posts: 7596 Location: Bristol, UK

Hijacking the connection you have with your service provider, while technically possible, is extremely rare and dependant on overcoming other security measures other than the https encryption on the link to a specific website.

If it were achieved, the 'Man In the Middle' could just as easily mimic the https page that contains the login form, and the vast majority of users would never notice... and obtain the credentials anyway... via people logging into Ebay itself without them needing to have used Gixen at all, that is certainly what I would do if I was formulating a strategy to obtain Ebay credentials... So, I don't think your analysis actually stands up to argument... and I'm sure it has never even been attempted with Gixen, let alone achieved.

Pretty much everyone is already aware that you have to be extra careful with all your site usage when using open Wifi, and unsecured public computers and networks anyway... and this is why.
_________________
Mark

Gixen · Advertisements

Guest · Posted: Tue Jul 12, 2016 11:27 am Post subject:

While a MITM could hijack the connection, HTTPS would prevent this (or more specifically, would at least warn me)

Is there a compelling reason to force delivery the login page over HTTP rather than HTTPS?

Cupid · Joined: 09 Aug 2007 Posts: 7596 Location: Bristol, UK

The compelling reason is that the login form is presented on every page.

Many of those pages also host adverts, which help support the platform and enable the free service to remain available.

In order for those adverts to be possible the pages have to be http not https.

As indicated above the actual credentials are sent securely... I am still of the view that your argument is not sufficient to warrant or require a change in policy which is in line with many other secure websites.
_________________
Mark