Return to Question

Here I am with https://tor.meta.stackexchange.com/questions/ask loaded, writing my question. When I click "post", it's going to send my stackexchange credential cookie, yet again, over cleartext.

In this case I happen to be using Tor, so some exit relay, and anybody on the network between that exit relay and the website, gets to see my cookie and log in as me if they want.

Even if I weren't using Tor, exactly the same issue applies when I'm at a hotel network, conference network, coffeeshop network, or even on my cablemodem at home where my neighbors can listen in on all my traffic.

There are some questions here in meta already about getting SE to set up a Tor hidden service. That's a fine backup plan. But I think we should encourage them to make the whole site (that is, Tor's part of it -- but I recognize that it should go broader than that) https-enabled. Does anybody know the right steps, and/or the right people, for making this happen?

Here I am with http://meta.tor.stackexchange.com/questions/ask loaded, writing my question. When I click "post", it's going to send my stackexchange credential cookie, yet again, over cleartext.

In this case I happen to be using Tor, so some exit relay, and anybody on the network between that exit relay and the website, gets to see my cookie and log in as me if they want.

Even if I weren't using Tor, exactly the same issue applies when I'm at a hotel network, conference network, coffeeshop network, or even on my cablemodem at home where my neighbors can listen in on all my traffic.

There are some questions here in meta already about getting SE to set up a Tor hidden service. That's a fine backup plan. But I think we should encourage them to make the whole site (that is, Tor's part of it -- but I recognize that it should go broader than that) https-enabled. Does anybody know the right steps, and/or the right people, for making this happen?

Here I am with http://meta.tor.stackexchange.com/questions/ask loaded, writing my question. When I click "post", it's going to send my stackexchange credential cookie, yet again, over cleartext.

In this case I happen to be using Tor, so some exit relay, and anybody on the network between that exit relay and the website, gets to see my cookie and log in as me if they want.

Even if I weren't using Tor, exactly the same issue applies when I'm at a hotel network, conference network, coffeeshop network, or even on my cablemodem at home where my neighbors can listen in on all my traffic.

There are some questions here in meta already about getting SE to set up a Tor hidden service. That's a fine backup plan. But I think we should encourage them to make the whole site (that is, Tor's part of it -- but I recognize that it should go broader than that) https-enabled. Does anybody know the right steps, and/or the right people, for making this happen?

Here I am with https://tor.meta.stackexchange.com/questions/ask loaded, writing my question. When I click "post", it's going to send my stackexchange credential cookie, yet again, over cleartext.

In this case I happen to be using Tor, so some exit relay, and anybody on the network between that exit relay and the website, gets to see my cookie and log in as me if they want.

Even if I weren't using Tor, exactly the same issue applies when I'm at a hotel network, conference network, coffeeshop network, or even on my cablemodem at home where my neighbors can listen in on all my traffic.

There are some questions here in meta already about getting SE to set up a Tor hidden service. That's a fine backup plan. But I think we should encourage them to make the whole site (that is, Tor's part of it -- but I recognize that it should go broader than that) https-enabled. Does anybody know the right steps, and/or the right people, for making this happen?