Login security

Jabba_flabba

Hello,

I was wondering why this site's login form sends usernames and passwords in plain text, when MSE has a valid SSL certificate with a SAN of *.moneysavingexpert.com, which would cover forums.moneysavingexpert.com

?

Any plans to sort this out?

Jabba_flabba

No interest from any of the site admins?

Former_MSE_Andrea

Thanks for posting! I've asked the tech team and will let you know when I have an update

Former_MSE_Andrea

Jabba_flabba wrote: »

Hello,

I was wondering why this site's login form sends usernames and passwords in plain text, when MSE has a valid SSL certificate with a SAN of *.moneysavingexpert.com, which would cover forums.moneysavingexpert.com

?

Any plans to sort this out?

Hi,

Just to catch up with you on this Jabba_flabba, migration from HTTP to HTTPS isn't a simple process but it is in the pipeline across all MSE subdomains including the Forum.

Jabba_flabba

That's great to hear Andrea. Thanks for following this up.

Happygreen

Any news on this yet?

Sooler

Firefox, Chrome start calling HTTP connections insecure
https://arstechnica.com/information-technology/2017/01/firefox-chrome-start-calling-http-connections-insecure/

The non-secure label should encourage to developers to reduce their use of HTTP and make the switch to HTTPS whenever sensitive data is being handled.

Former_MSE_Andrea

Hi all

We've answered this as a new thread so everyone can see our reply easily.

https://forums.moneysavingexpert.com/discussion/comment/72027723#Comment_72027723

Jabba_flabba

So @MSE Andrea ... seven months on since I raised this, has any progress been made on planning the roll out of SSL?

Former_MSE_Andrea

Hi Jabba_flabba, it's still in the pipeline. We'll update you when we have more news.

Jabba_flabba

Some of you may be aware of the WPA2 vulnerabilities that were publicised today. See https://arstechnica.com/information-technology/2017/10/how-the-krack-attack-destroys-nearly-all-wi-fi-security/

The fact that WPA2 is now vulnerable means you cannot rely on it to protect you from sites that fail to implement TLS security (such as this site). This is worrying because it means it's not just open wifi networks where your user/password/other sensitive info could be intercepted.

Can anyone tell me why 10 months have passed and still we have no TLS security? Can it be that hard?