1106677 - Firefox China Index page email password transferred in cleartext

Status: RESOLVED FIXED

(Mozilla China :: General, defect)

Description

[varas]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

Steps to reproduce:

Firefox Index page(Many Firefox versions in China)-->www.huohu123.com-->Login Email


Actual results:

Many Email password transferred in cleartext  though many Email vendors above provide https api for login.


Expected results:

Email password transferred in https request or something safe(Email vendors can provide safe api)

Comment 1

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 2

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 3

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 4

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 5

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 6

[varas]

Attachment: http request with password in cleartext from Firefox index page

Comment 7

[Daniel Veditz [:dveditz]]

jlu: do you know who should get this bug? It appears to be a problem with the www.huohu123.com site, not a bug in the Firefox product but I can't find an appropriate Bugzilla component for it.

I assume this is relating to the login box at the top of the page. Even if we made the form submit over https it's still not secure to have a password field on the http://www.huohu123.com site itself. But if you only worry about passive sniffing attacks (common and easy anywhere there is wifi) then fixing the form submission would be at least an improvement.

There does not appear to be a secure version of https://www.huohu123.com/

Comment 8

[John Lu [:mnjul][Please NI or I'll miss]]

I don't have an idea in the slightest :( If this can only be fixed at the website's host/origin then we probably need a Tech Evangelist to reach out the website owner; or if there is anything Mozilla can do then we need to figure out what we'd like to do and categorize appropriately.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

CC'ing some folks from Mozilla Online.

Comment 10

[Hector Zhao [:hectorz]]

(In reply to John Lu [:mnjul] [MoCoTPE] from comment #8)
> I don't have an idea in the slightest :( If this can only be fixed at the
> website's host/origin then we probably need a Tech Evangelist to reach out
> the website owner; or if there is anything Mozilla can do then we need to
> figure out what we'd like to do and categorize appropriately.

This site is owned by Mozilla Online at Beijing.

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #9)
> CC'ing some folks from Mozilla Online.

Thanks for bring this to our attention.

Comment 11

[Hector Zhao [:hectorz]]

Update: I just confirmed with relevant owner/developer, this email login field has been removed. Thanks!