591524 - SSL Needed for Login Landing Page on spreadfirefox.com

Status: VERIFIED DUPLICATE of bug 412354

(Websites Graveyard :: spreadfirefox.com, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The login landing page (the page that accepts the username and password) is accessible over HTTP or HTTPS. A user that views the login page over HTTP could be subjected to a man in the middle attack that could steal the user's credentials after they are entered. The MitM could launch this attack by simply modifying the form's action attribute and forcing the form to post the credentials to the attacker's site instead.

In addition, if the login page is accessed over HTTP this site will also post the credentials over cleartext HTTP.


Recommended Remediation

The login landing page (www.spreadfirefox.com/user?destination=node) should only be accessible over HTTPS. Any attempts to access the page over HTTP should result in a redirect to the HTTPS version.

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

This one didn't get picked up when it was filed. We need someone to tackle this issue.

Comment 2

[Wil Clouser [:clouserw]]

mmhmm.  Took over 2 years to close this bug the first time I filed it.  I see it's been reopened.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified duplicate.