HTTP Shaming

(Nicely) shaming websites and apps that don't encrypt user data in transit – by @webster

[HTTP Shaming @HTTPshaming]

For some background information on #HTTPshaming, see here: http://t.co/nafSwzf6Vl

[HTTP Shaming @HTTPshaming]

India satellite TV provider @videocond2h sends usernames, passwords, names, addresses, insecurely https://t.co/5AOu2VS96X

[HTTP Shaming @HTTPshaming]

Pandora's website transmits emails, passwords, dates of birth, and credit card numbers insecurely #httpshaming https://t.co/HqrfQzoTY4

[Tyler Butler @primarytyler]

@HyattConcierge Why don't you have an SSL certificate on your site? Nobody should sign in on an unsecure connection!

[HTTP Shaming @HTTPshaming]

The @Toyota Owners website sends name, email, home address, password, and vehicle VIN over insecure HTTP http://t.co/NyVIjXuYTZ

[David Stainton priv/acc @david415]

Dear @HTTPshaming, please PLEASE help me shame @Raspberry_Pi until they turn on https for distributing images+hashes http://t.co/M7n4iQlbjT

[HTTP Shaming @HTTPshaming]

@jsfiddlesupport Thanks for the update. I understand implementing HTTPS isn’t easy on a complex production site – appreciate your efforts!

[HTTP Shaming @HTTPshaming]

@jsfiddlesupport I’m still seeing HTTP on the site and for user login. Are the changes live?

[HTTP Shaming @HTTPshaming]

White House seeks technologists for new @USDS, but application form sends applicant data insecurely http://t.co/zP9AU5vkQS

[HTTP Shaming @HTTPshaming]

.@WebMD insecurely transmits your health condition and symptom information http://t.co/WuIi3fNb8O #httpshaming

[HTTP Shaming @HTTPshaming]

Twitter account management service @ManageFlitter uses insecure HTTP, puts your Twitter account at risk http://t.co/ctwacQZpsQ

[HTTP Shaming @HTTPshaming]

We love you @JSFiddle, but could you please use HTTPS to protect user data? http://t.co/OgysyTPZ5x

[HTTP Shaming @HTTPshaming]

@eliheady That said, the point was that HTTPS is a first, basic step. Any single vulnerability can have any number of vectors to exploit it.

[HTTP Shaming @HTTPshaming]

@eliheady Yup. If a user’s DNS is poisoned so that an ‘A’ record points to another IP for MFP’s domain, certificate mismatch w/ HSTS.

[HTTP Shaming @HTTPshaming]

.@MyFitnessPal forces insecure HTTP, transmits private health data insecurely, promised full HTTPS 2 years ago http://t.co/Zi4003U0Dj

[HTTP Shaming @HTTPshaming]

@voodooKobra They do, but they also need to not actively take away users’ freedom to do it themselves while they sit on their hands :(

[HTTP Shaming @HTTPshaming]

@voodooKobra Sadly users can’t even do that. If you change your A records away from Tumblr (e.g. to CloudFlare) they kill your custom domain

[HTTP Shaming @HTTPshaming]

@voodooKobra Yeah, makes no sense. And only for your Tumblr dashboard, not reading Tumblr blogs.

[HTTP Shaming @HTTPshaming]

Thank you @Scribd! Passwords were previously sent in the clear, but now Scribd is all-SSL. <3
http://t.co/1JOaC4BVjA

[HTTP Shaming @HTTPshaming]

The website for @SouthwestAir is a security mess: bookings, check-ins, flight changes all unencrypted http://t.co/nQTZUSHKPi

[HTTP Shaming @HTTPshaming]

@pornelski @slightlylate Do you have a specific citation to something I could revise? Constructive criticism is more than welcome.