Security: http scheme allowed for oauth account plugins.
Bug #1343093 reported by
UserError
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Switchboard Online Accounts Plug |
Confirmed
|
Critical
|
Unassigned | ||
Bug Description
Where possible shouldn't it be https only?
As we can currently set per provider if they are able to use http or https, we should evaluate which ones do support https and remove http support for them to add a little bit of extra security for your account.
| summary: |
- Security: http schemes allowed for oauth account plugins. + Security: http scheme allowed for oauth account plugins. |
| information type: | Public → Public Security |
Revision history for this message
| Sergey "Shnatsel" Davidoff (shnatsel) wrote | #1 |
| description: | updated |
| Changed in elementaryos: | |
| status: | New → Confirmed |
| importance: | Undecided → Critical |
| affects: | elementaryos → switchboard-plug-onlineaccounts |
| Changed in switchboard-plug-onlineaccounts: | |
| milestone: | none → loki-rc1 |
| Changed in switchboard-plug-onlineaccounts: | |
| milestone: | loki-rc1 → loki+1-beta1 |
To post a comment you must log in.
Depends. It should be HTTPS-only for Internet services, but most likely HTTP-only for networks with better transport security, such as Hyperboria.
So if you're going to force HTTPS (which is a good thing - protects against downgrading to HTTP, a-la SSLstrip), do it on a per-plugin basis.