Firefox gets complaint for labeling unencrypted login page insecure
Sorry! That’s a feature not a bug.
The operator of a website that accepts subscriber logins only over unencrypted HTTP pages has taken to Mozilla's Bugzilla bug-reporting service to complain that the Firefox browser is warning that the page isn't suitable for the transmission of passwords.
"Your notice of insecure password and/or log-in automatically appearing on the log-in for my website, Oil and Gas International, is not wanted and was put there without our permission," a person with the user name dgeorge wrote here (update: the link is no longer public). "Please remove it immediately. We have our own security system, and it has never been breached in more than 15 years. Your notice is causing concern by our subscribers and is detrimental to our business."
Update: Around the same time this post was going live, participants of this Reddit thread claimed to hack the site using what's known as a SQL injection exploit. Multiple people claimed that passwords were stored in plaintext rather than the standard practice of using cryptographic hashes. A few minutes after the insecurity first came up in the online discussion, a user reported the database was deleted. Ars has contacted the site operator for comment on the claims, but currently Ars can't confirm them. The site, http://www.oilandgasinternational.com, was displaying content as it did earlier at the time this update was made.
As a member of the Mozilla developer team pointed out in reply to the complaint, both Firefox and Chrome routinely issue warnings whenever users encounter a login page that's not protected by HTTPS encryption. The warnings became standard earlier this year.
That same user wrote:
Quote:
When your site requests a user's password over HTTP, the transmission of these passwords is done in the clear. As such, anybody listening on the network would be able to record those passwords. This puts not just users at risk when using your site, but also puts them at risk on any other website that they might share a password with yours.
One can only imagine such exchanges between uninformed website operators and browser makers are becoming a regular occurrence since the warnings made their debut a couple months ago. This exchange is notable for the confidence dgeorge has in the unspecified "security system" of the website and the assertion the site has never been breached in more than 15 years. Frequently, there's no way to detect the type of attack Firefox and Chrome are trying to prevent with these warnings.
The complaint appears to involve this HTTP-based login page for oilandgasinternational.com. When viewed on Firefox, the following words are displayed immediately below both the user name and password fields: "This connection is not secure. Logins entered here could be compromised." It then offers a link to additional information.
Chrome, meanwhile, displays the words "not secure" in front of the login URL. Clicking on the warning brings up a more detailed warning. Update: As several commenters have pointed out, the site's subscription page transmits credit card information over plain-vanilla HTTP pages as well. The lack of protection is made worse by the assurance on the same page that: "All credit card information is encrypted using our Secure Transaction Server." Making matters worse still: the login page is returning error messages that indicate it may be vulnerable to SQL injection attacks.
Ars has e-mailed user dgeorge, who is listed on the site's contacts page, and asked for comment. Dgeorge didn't respond as this post was going live and later was updated.
