HTTP Shaming

Adam4Adam

Adam4Adam, a homosexual dating/relationship/romance site, loads a login type insecurely over HTTP – after which articles the login insecurely to HTTP. Anyone network that is intercepting could be in a position to visit your login qualifications in plaintext.

(Submitted by Isaac)

Unrelated protip:

That is additionally a good time and energy to remind everybody that even HTTPS will maybe not conceal web sites you go to, simply this content you take on them.

You may desire to contemplate using a VPN if you’d like both defenses. Constantly browse the privacy, information retention policies, and terms of good use for just about any VPN provider to ensure your computer data privacy will be honored.

1. jameschen141 liked your

See more articles similar to this on Tumblr

More you may like

WinSCP

The WinSCP web site is hosted on insecure HTTP, as well as the binary executable downloads over HTTP too. Whilst the website comes with checksums for the packages, the checksums are hosted on a single HTTP web site, and may effortlessly be modified in a man-in-the-middle assault.

(Submitted by Lenard Szolnoki)

”VirtualBox for OS X upgrade checker fingers out unencrypted down load links for brand new variations. Changing HTTP to HTTPS can certainly make the down load fail.”

(Submitted by Anonymous)

4Sync

4Sync’s website lots as HTTP with a login kind, which posts to HTTPS. As aisle dating website previously mentioned several times before, publishing to HTTPS won’t save you in case your login type is packed on HTTP with injected javaScript that is malicious tracks keystrokes, changes PUBLISH places, etc. Both the web web page with all the kind, and also the publishing location should always be HTTPS.

“4Sync.com is really a file syncing solution and a competing to Dropbox. But until they fix their SSL, I’m perhaps not likely to subscribe!”

(Submitted by Max)

Dymocks Booksellers in Australia does not make use of SSL while accepting charge card figures. Both the web page using the type plus the POSTing location use HTTP. Any bank card figures joined right here will be insecure.

You may think you could utilize PayPal’s secure gateway, but simply clicking radio stations switch for the PayPal option does nothing at all.

(Submitted by Matt)

TriniCarsForSale.com, a vehicle classifieds web site for Trinidad and Tobago, takes private information, driver’s license figures, and bank card information over an unsecured HTTP connection.

(Submitted by Ryan Shripat)

Stanford University – Center for Pro Developing

Stanford University’s Center for pro developing acts its website landing page over HTTP with a login kind. Although the form does POST over HTTPS, past articles have highlighted the risk for the reason that (injection attack to improve POST location, malicious JavaScript, etc.)

A compromise in site credentials allows an assailant to achieve in-depth scholastic and history that is professional of and present students.

Possibly they ought to simply simply just take their very own advice, as detailed within their Advanced Computer protection courses.

(Submitted by anonymous)

Ubiquiti acts handbook router update over HTTP

Ubiquiti’s website to down load router firmware improvements operates on HTTP, as well as the firmware .tar files will also be offered over HTTP.

And the thing I is only able to answer by banging my mind contrary to the wall surface, the internet site does provide HTTPS pleased with a legitimate ssl certification, nonetheless it redirects all traffic to HTTP. For genuine.

Can somebody state “NSA authorized router upgrade”?

Ubiquiti, fix this! 🙂

Hey @ubnt, your router improvements over are offered over ordinary HTTP. That’s bad. Please allow HTTPS/TLS! cc @webster

(Submitted by axelsimon)

[RESOLVED] Safe In Cloud’s site that is entire now operating on HTTPS. Many Many Thanks, Safe In Cloud!

Secure In Cloud is really a password administration service that serves their Windows executable over HTTP!

(Submitted by Abraham Williams)

“This could be the web web page of enrollment of a event that is computing of college, the ‘Computing Week’. This is certainly merely a pity they require my charge card quantity utilizing a simple http page. The shape can also be delivered with http POST. Wrong on a lot of amounts.”

(Submitted by Guilherme Bernal)

Asia satellite television provider Videocon d2h sends usernames, passwords, individual information insecurely

Videocon d2h, a direct-to-home satellite television provider in Asia, will not utilize HTTPS on its site. All connections look at insecure HTTP.

This is certainly especially concerning from the “My d2h” element of your website, which gathers usernames, passwords, satellite card figures, client ID numbers, mobile figures, details, and information that is billing. Many of these details may be intercepted on a monitored or available network that is wi-fi.

d2h uses third-parties to process re payment card data – Citrus, TechProcess possibilities Ltd, or CC Avenue – all of which may actually make use of HTTPS, but information that is personal is transmitted both pre and post transactions when you look at the clear.

Videocon d2h has been able to implement HTTPS on its form that is login for and suppliers. It will be great when they cared in regards to the safety of the clients up to the protection of the company that is own’s.