Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
@Fast-Nop Well, that's why you redirect immediately all traffic to the HTTPS site and never provide a login form through an unencrypted connection.
-
@ethernetzero Correct, but the browser-side application itself doesn't encrypt and relies on network encryption instead.
It wouldn't even be good if every browser application started encrypting itself because that would get tons of security holes. Crypto is not only hard to design, it's also hard to implement correctly. -
@Fast-Nop What you're saying is right and I agree with you, but we both are assuming things from the op that he hasn't really said. Until he clarifies if he was talking about using TLS connections and the other guy was referring to “insecure networks” as public WiFi networks or something like that, we don't really know the whole of the story.
Heck, we don't even know for sure if it's a web application. -
@ethernetzero from the sounds of it, it's some software that requires a login, on a server and the software doesn't do end-to-end encryption.
OP never mentioned the web, only sending login information with software unencrypted. In other words, it doesn't do anything until it hits the server so if you use WireShark to sniff the packet at the user, all the information is plaintext in the packet.
That's like, if you knew nothing and learned WireShark today, that'd be like your first lesson lol. -
@CodeBane Yeah, it sounds like it.
-
@CodeBane You nailed it, pretty much
Related Rants
Did you say security?
Had a discussion with a developer about security. His software transfers all user data (password and files) unencrypted, so anyone can grab them with wireshark. I told him that this is a severe issue. He said no its no problem because if you get hacked its your own fault, because you probably used an insecure network. NO ! YOU FUCKING MALADJUSTED SHEEP-MOLESTING OBJECT OF EXECRATION, YOU SHOULD ALWAYS ENCRYPT SENSITIVE USERDATA NO MATTER WHAT NETWORK YOU USE. FUCKING KILL ME ALREADY.
Not implementing encryption is one thing but then acting like its no problem is a fucking nother one. Why do people not understand that security of userdata is important???
rant
idiots
developers
security