As a site dedicated to IT Security, we commonly find ourselves preaching about things like HTTPS, salted and hashed passwords, and such. However our own website is in violation of some of the security standards we so vehemently profess.
One particularly glaring example is the lack of proper HTTPS support on the IT Security StackExchange site and blog. For the main and meta site, some of this is mitigated by the availability of third-party OpenID providers who do use HTTPS. However, this is not an option for the blog's administrative interface where in-the-clear HTTP appears to be the only way to connect. Users who choose to create a StackExchange account with StackExchange's OpenID provider are also left to presume they are sending their credentials over clear HTTP.
EDIT: Bruno has pointed out that StackExchange's OpenID provider actually does use HTTPS, but it's not done in a way that will be apparent to most end-users. Also, there's no way to validate the presence or authenticity of that function without reviewing the login page code every time.
This particular example is, I'm sure, just one among several issues that could affect our security as users of the StackExchange network. These same issues could also impact our reputation and credibility as an IT Security community.
StackExchange has already had at least one major security compromise, as Jeff confessed to in a couple blog entries:
There are also several security-relevant suggestions (below are just a few) on Meta which have either been deferred, declined, or in some other way seem to be brushed aside.
- Why doesn't the Stack Overflow team fix the Firesheep-style cookie theft?
- Some other threads on MSO, and one on our own Meta, also request this.
- I'd like to see the last few IP addresses that my account was used from please!
- Allow HTTPS on Careers
While there may be some logical business reasons for not implementing these requests (or not implementing them "properly"), I'd like to think there's also something we could do about it. We are a community of IT Security professionals - engineers, programmers, auditors, pentesters. Surely among us we could find some way to help better secure StackExchange.
There may be some particular knowledge or work resource that SEI lacks, which someone here could volunteer or offer at a discount. Or, maybe someone here with a security-focused mind and a wealth of experience-based technical knowledge could volunteer their time to consult with an open ear at SEI who could make some changes.
I really don't know what it will take or what SEI might accept, and maybe this is just a pipe dream, but I know we've got a lot of resources in this community and there's got to be something we can do to help. What kind of ideas do you have?