Bug/Site Problem: Passwords sent in plaintext

[SnowFox]

When you change anything in your account settings you have to enter your password, but if you get there by following the links in the control panel you you'll end up at http://www.furaffinity.net/controls/settings/ which will then submit your password insecurely as plaintext (unless I'm being stupid and broke something on my end). Doesn't this sort of defeat the purpose of having an SSL login page?

Perhaps the account settings page should always redirect itself to https like the login page does?

 

[kayfox]

Yeah, they know about this, its been at least 4 years...

http://xheotris.zerda.net/~kayfox/fa-cain-12jan2007.gif

Wait till you find out about session hijacking!

 

[DW_]

Didn't we find out the same exact thing was wrong with the PSN a few months ago? Or was I just dreaming that 77 million users (including myself) had their details breached?

 

[Onnes]

For those wishing to avoid this problem, the HTTPS Everywhere plugin for Firefox can be used to automatically redirect links to the secured pages. This post has a particular script for FurAffinity.