27

When trying to access https://security.stackexchange.com I get redirected to regular HTTP.

In case I'd be using a public wifi someone could simply hijack my session and post whatever they want or even change the profile without being prompted for a password. Is there some security measure that I am not aware of?

9
  • Thanks! Strange that it's so hard to find with search. For the time being, let's just hope everyone uses VPN to some secure location...?
    – Indrek
    Commented Nov 9, 2012 at 20:35
  • 3
    How does VPN solve the problem? If you can put yourself between the VPN endpoint and SE you still will get owned
    – Lucas Kauffman
    Commented Nov 9, 2012 at 20:54
  • 2
    @LucasKauffman True, but generally it's less likely than e.g. someone hacking the coffee shop's WiFi and sniffing your credentials on that end if you don't use the VPN.
    – Iszi
    Commented Nov 10, 2012 at 0:57
  • 1
    @JeffFerland Isn't there already a dupe of this here or on the main site?
    – Iszi
    Commented Nov 10, 2012 at 1:02
  • 1
    @Iszi Didn't you ask a question about it?: meta.security.stackexchange.com/questions/841/…
    – user10211
    Commented Nov 10, 2012 at 3:48
  • @TerryChia That one's not specifically just about this issue, but it does mention there's a duplicate somewhere around here.
    – Iszi
    Commented Nov 10, 2012 at 3:49
  • @Iszi agreed that it is less likely, but it doesn't solve the issue.
    – Lucas Kauffman
    Commented Nov 10, 2012 at 8:53
  • @LucasKauffman It may not solve it completely, but it drastically reduces the probability of exploitation. This is one of those scenarios where you have to weigh the value of security vs. usability. Really, the probability that anyone is going to get between the VPN endpoint and SE is about the same as them getting between your system at home or work and SE. It's one of those situations where you generally have to concede that "there is no such thing as perfect security", and just do the best you can - and (absent HTTPS) VPN is the best you, the end-user, can do.
    – Iszi
    Commented Nov 10, 2012 at 15:11
  • status-planned
    – Gilles 'SO- stop being evil'
    Commented Jun 5, 2013 at 12:33

3 Answers 3

Reset to default
19

We're a part of the StackExchange network, and the moderators of the site don't have any control of the underpinning. Thus, whatever happens on the whole StackExchange network happens to us.

See Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

1
  • 5
    HTTPS used to work, at least partially. Now it's completely gone with no timeline for adoption.
    – Null
    Commented Nov 20, 2012 at 18:06
5

My first guess is that advertising won't support HTTPS therefore making a mixed session and the user having to deal with the browser "do you want to continue" dialogs

More information: https://stackoverflow.com/q/3485897/328397

3

FYI I put a bounty on the two most(?) relevant meta.SO s:

Please feel free to append your bounties when mine expires until this is finally implemented, and also mention posts I forgot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .