When trying to access https://security.stackexchange.com I get redirected to regular HTTP.

In case I'd be using a public wifi someone could simply hijack my session and post whatever they want or even change the profile without being prompted for a password. Is there some security measure that I am not aware of?

share

migrated from security.stackexchange.com Nov 9 '12 at 21:24

This question came from our site for Information security professionals.

    
Thanks! Strange that it's so hard to find with search. For the time being, let's just hope everyone uses VPN to some secure location...? –  Indrek Nov 9 '12 at 20:35
3  
How does VPN solve the problem? If you can put yourself between the VPN endpoint and SE you still will get owned –  Lucas Kauffman Nov 9 '12 at 20:54
2  
@LucasKauffman True, but generally it's less likely than e.g. someone hacking the coffee shop's WiFi and sniffing your credentials on that end if you don't use the VPN. –  Iszi Nov 10 '12 at 0:57
1  
@JeffFerland Isn't there already a dupe of this here or on the main site? –  Iszi Nov 10 '12 at 1:02
1  
@Iszi Didn't you ask a question about it?: meta.security.stackexchange.com/questions/841/… –  Terry Chia Nov 10 '12 at 3:48
    
@TerryChia That one's not specifically just about this issue, but it does mention there's a duplicate somewhere around here. –  Iszi Nov 10 '12 at 3:49
    
@Iszi agreed that it is less likely, but it doesn't solve the issue. –  Lucas Kauffman Nov 10 '12 at 8:53
    
@LucasKauffman It may not solve it completely, but it drastically reduces the probability of exploitation. This is one of those scenarios where you have to weigh the value of security vs. usability. Really, the probability that anyone is going to get between the VPN endpoint and SE is about the same as them getting between your system at home or work and SE. It's one of those situations where you generally have to concede that "there is no such thing as perfect security", and just do the best you can - and (absent HTTPS) VPN is the best you, the end-user, can do. –  Iszi Nov 10 '12 at 15:11
    
status-planned –  Gilles Jun 5 '13 at 12:33

3 Answers 3

up vote 15 down vote accepted

We're a part of the StackExchange network, and the moderators of the site don't have any control of the underpinning. Thus, whatever happens on the whole StackExchange network happens to us.

See Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

share
3  
HTTPS used to work, at least partially. Now it's completely gone with no timeline for adoption. –  Null Nov 20 '12 at 18:06

My first guess is that advertising won't support HTTPS therefore making a mixed session and the user having to deal with the browser "do you want to continue" dialogs

More information: http://stackoverflow.com/q/3485897/328397

share

FYI I put a bounty on the two most(?) relevant meta.SO s:

Please feel free to append your bounties when mine expires until this is finally implemented, and also mention posts I forgot.

share

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .