6
$\begingroup$

Should an Exchange about Cryptography utilize SSL encryption on it's website?

I'm not quite sure what the cost is, or how these are given out on the Exchange, but it seems pretty silly not to provide users with the basic protections provided by SSL:

  • Verification of Origin
  • URI Obfuscation
    • Nobody other than the client and server know which page is actually being requested.
  • Proper usage
    • Be a shining example on how to correctly use SSL/HTTPS.
$\endgroup$
4

1 Answer 1

Reset to default
7
$\begingroup$

Yes, we should.

Unfortunately StackExchange is an USA based company. With the extremely weak consumer protection and privacy laws in the USA, StackExchange does not consider the exposure of email addresses and ip-addresses (moderator tools) and account highjacking an issue.

Please see Why doesn't the Stack Overflow team fix the Firesheep style cookie theft? for an official statement on this issue.

SSL is not as expensive anymore than it used to be in the past. Yes, it still creates a bit of overhead, but given the privacy implication, I consider that negligible.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .