Why Livejournal's Loss of HTTPS Is A Thing
Jan. 2nd, 2017 08:11 am![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
morgandawnWhat's new about LJ is that they've turned off secured browsing (HTTPS ) so when you log into your account, your password can be seen by anyone monitoring the site and anyone else long the way (in transit). The payment page still seems to be encrypted (for now). The lack of HTTPS security also means anything you post under lock is also accessible and your personal identity can be stolen
Edited: install HTTPS EVERYWHERE which can be found at eff.org. It won't magically replace missing security (like what is happening on Livejournal), but it will turn on security if it is available. Ex: Up until 2013, on Facebook you had the option to have secured browsing. Or not. HTTPS Everywhere will toggle it on for you in case you mess up your default security settings
In the end my advice: make a new password just for LJ, do not pay anything through them and realize that anything you post or read there there can be intercepted by others
"There’s an important distinction between tweeting to the world or sharing thoughts on Facebook and having your browsing activity going over unencrypted HTTP. You intentionally share tweets, likes, pics and thoughts. The lack of encryption means you’re unintentionally exposing the controls necessary to share such things. It’s the difference between someone viewing your profile and taking control of your keyboard.....
...If my linguistic metaphors have left you with no understanding of the technical steps to execute sniffing attacks, you can quite easily execute these attacks with readily-available tools. A recent one is a plugin you can add to your Firefox browser. The plugin, called Firesheep, enables mouse-click hacking for sites like Amazon, Facebook, Twitter and others. The creation of the plugin demonstrates that technical attacks can be put into the hands of anyone who wishes to be mischievous, unethical, or malicious.
To be clear, sniffing attacks don’t need to grab your password in order to impersonate you. Web apps that use HTTPS for authentication protect your password. If they use regular HTTP after you log in, they’re not protecting your privacy or your temporary identity"
Edited: install HTTPS EVERYWHERE which can be found at eff.org. It won't magically replace missing security (like what is happening on Livejournal), but it will turn on security if it is available. Ex: Up until 2013, on Facebook you had the option to have secured browsing. Or not. HTTPS Everywhere will toggle it on for you in case you mess up your default security settings
(no subject)
Date: 2017-01-03 04:31 am (UTC)Sounds fairly straightforward to me.
I thought of FireSheep in the midst of reading that LJ undid https:// support, too, but the thing is - if I recall correctly - that's not dependent on a site not having https:// support, but works regardless of secure connection by passing unencrypted cookies to the FireSheep user.
I'm not sure if DW encrypts its cookies or not* (see partial answer, below). And I don't know if LJ ever did, though I'm sure with dropping https:// support, if they did, they probably no longer do.
ETA*: it might depend on how one connects to DW, and for testing purposes I've been connecting tonight through both http:// and https://, so I think that's why I've got something like five encrypted Dreamwidth cookies and three unencrypted ones in my browser right now.