Gaia online now unsecured???

[granturismo]

I'm on gaiaonline right now and i keep refreshing my internet browser and move to different parts of the site and apparently i keep still getting the slash throught the HTTPS. and the lock before it has an x on it.

go to this link for a picture of it.

http://tinypic.com/r/330bk39/7

[Personoid]

I don't remember Gaia ever fully supporting HTTPS.

[granturismo]

well they did it just looks like a regular HTTPs with nothing going through it or the lock saying secured website but the regular sites have just HTTP thats it but gaia right now has a slash through it and may be a breaking point for us to steal some stuff from it like account info or some other crap like that.

[Personoid]

I'm pretty sure the only way that makes a difference is if you can intercept someone logging into Gaia. Like Firesheep or whatever.

I thought so. It's never fully supported https. None of the links on the page are loaded via HTTPS. Clicking on any link will take you back to http://whatever vs https://whatever.

[granturismo]

true but it was regularly not like this like it is now.

[Personoid]

When you visit Gaia normally, it doesn't load with HTTPS.
i.e. Typing "gaiaonline.com" into the address bar doesn't result in https://www.gaiaonline.com/ . It's just http://www.gaiaonline.com

[Artificial]

The most likely scenario is that they're attempting to load a non-secure image/css/js file. i.e. from https:// they're attempting to load a resource using the http:// protocol. I guess, technically, it is a bit of a concern, as someone monitoring your network would be able to retrieve the session id stored in a cookie sent with the request. However, I would be very surprised if the login system system went from https -> http, so your username and password should be safe.

It's only really an issue if you're on an open or insecure network.

[Personoid]

The most likely scenario is that they're attempting to load a non-secure image/css/js file. i.e. from https:// they're attempting to load a resource using the http:// protocol. I guess, technically, it is a bit of a concern, as someone monitoring your network would be able to retrieve the session id stored in a cookie sent with the request. However, I would be very surprised if the login system system went from https -> http, so your username and password should be safe.

It's only really an issue if you're on an open or insecure network.

https://gaiaonline.com/auth/login actually does contain a form that submits to http://gaiaonline.com/auth/login and all links on pages loaded with https:// actually lead to unsecured pages.

[granturismo]

agreed but lets find out why xD

[Personoid]

agreed but lets find out why xD

The reason is that Gaia never set it up for HTTPS properly. It's been this way for ages.
When you run a website, if you want to support people connecting via HTTPS, you have to set it up for that.

[granturismo]

ohh so thats why its so easy to hack them xD

[Personoid]

ohh so thats why its so easy to hack them xD

No, the only way you can hack someone because of this is via Man-in-the-middle attack - Wikipedia, the free encyclopedia.