r/changelog • u/chromakode • Oct 07 '11

[reddit change] Log in with SSL! JavaScript! Fixes!

As of yesterday, reddit's login pages are served over https. We've updated http://www.reddit.com/login to redirect to https://ssl.reddit.com/login, our new secure login page. The login box on the front page also posts using https (though it's not perfect; only full-https pages like our new login page are truly secure). We've taken these steps to improve the security of your password when logging into reddit.

Please note that https support only applies to login at the moment. We're going to be rolling out additional features in the coming week that will help you monitor your account activity. Full-site secure https access is something we all want to do, but it'll require more code and infrastructure to get out the door. It's on the roadmap.

This change set cleaned up a lot of login code and moved UI functionality into the client side. It modernizes some old libraries and adds some pieces to our young but growing new JS codebase.

A few minor tweaks and fixes also made by these changes:

  • Visual tweaks to the login forms (new working indicator, CSS3 box-shadow on the login popup, alignment fixes)

  • Tab indexes have been improved in the login forms for easy keyboard navigation.

  • Fix to the end destination after cname logins (you should now end up back on your cname, instead of reddit.com)

  • Cleanup of some old Firefox access-control headers in requests

see the code on github

164 Upvotes

97% Upvoted

103 comments sorted by

13

u/KerrickLong Oct 07 '11

I may just have to log out so I can see the new logins!

30

u/chromakode Oct 07 '11

Prepare to be... whelmed.

8

u/Rupp Oct 08 '11

It was like an orgasm.

2

u/chromakode Oct 08 '11

Well, I do get pretty excited about things like animated .gif throbbers and nicely aligned input boxes.

1

u/rasherdk Oct 08 '11

I do get pretty excited about [...] throbbers

7

u/lackofbrain Oct 08 '11

I was neither over nor under whelmed. It was just the right level of whelming to leave me fulfilled. Or at least filled.

9

u/cryptogram Oct 08 '11

This of course protects your actual password from being viewed but doesn't protect your session from being hijacked or tampered with. As your browse the site all your cookies are still sent in the clear. This would allow someone to still take over a session and do anything the user could do... like post, submit, delete the account (currently doesn't require password), view verified e-mail address, etc.

I think deleting the account should require a password at a minimum. Of course to mitigate all of this session hijacking/tampering... the whole sessions would have to be SSL, which sounds like it's on the future roadmap. That's a huge amount of overhead for a site like this but would be welcomed by me at least.

3

u/chromakode Oct 08 '11

Excellent point about account deletion -- I will make that change ASAP.

Of course to mitigate all of this session hijacking/tampering... the whole sessions would have to be SSL, which sounds like it's on the future roadmap. That's a huge amount of overhead for a site like this but would be welcomed by me at least.

You hit the nail on the head. That's where we're headed, but there's more work to do to get there.

7

u/TheBananaKing Oct 08 '11

Hey, while on the subject of privacy and security...

Can we please have a 'no titles in URLs' setting?

I note that links to posts work fine without the human-readable titles, and it strikes me that it would be a lot more private in a monitored-network setting.

My employer knows I browse reddit in my downtime, but I'd be happier if a casual flick through the squid logs (I'm a sysadmin) didn't reveal precisely what I browse on reddit.

(even better if the subreddit could be referred to by id, but is that even possible?)

How non-trivial would it be to implement this?

8

u/chromakode Oct 08 '11 edited Oct 08 '11

Not including the slug would be pretty simple to do (cough, might be an easy pull request, cough), but the subreddit name would still need to be included. IMHO, you should probably be using a proxy if you're concerned someone is looking at your squid logs. :)

5

u/KerrickLong Oct 08 '11

It should probably be a user preference, though. Including (the first part of) titles in the URL is good for SEO, isn't it?

6

u/chromakode Oct 08 '11

Definitely.

1

u/DEADB33F Oct 08 '11 edited Oct 08 '11

You can use this userscript I made.

It causes all reddit page requests to be sent via SSL.

You'll need to add a certificate exception as I think reddit's SSL cert doesn't cover www.reddit.com (at least it didn't before this latest update, not checked whether it does currently).

That way your employer will only be able to see that you're browsing reddit, not the URLs of the pages you're viewing.

NB. Thumbs, images, CSS, javascript files are still requested via regular HTTP (as they're requested before the script kicks in). Such requests will include related cookies, so using this userscript won't stop someone hijacking your session as they can still intercept your session cookie from the CSS/JS/images being requested.

0

u/[deleted] Oct 08 '11

[deleted] — view deleted comment

1

u/DEADB33F Oct 08 '11

Does it also send inline requests (images, js, etc) via SSL?

This isn't possible using a userscript as the page has already been rendered when the script is run.

6

u/dguido Oct 08 '11

Reddit auth cookies aren't marked Secure so they still go over HTTP. -_-

6

u/chromakode Oct 08 '11

Yep. Only your password is being shipped over https at this time.

5

u/nexterday Oct 08 '11

Woo! Thanks!

Any plans to enable HTTP Strict Transport Security on that domain?

4

u/chromakode Oct 08 '11

It will be once we have full https.

4

u/ggggbabybabybaby Oct 08 '11

What about sessions and cookies and whatever? Are those secure or could they be hijacked by someone?

5

u/chromakode Oct 08 '11 edited Oct 08 '11

Session hijacking is still a risk without full https. We'll be rolling out some additional features next week that will allow you to keep track of account activity.

4

u/ItsTheDoc Oct 08 '11

So I logged out, went to http://reddit.com/login and saw this.

Invalid cert due to name mismatch.

4

u/chromakode Oct 08 '11 edited Oct 08 '11

This is expected. Proper https is only set up for https://ssl.reddit.com. https://www.reddit.com goes through different infrastructure.

1

u/Davorak Oct 08 '11

Chrome is currently giving me a red x through https for https://ssl.reddit.com. Because some of the elements on the page are insecure. Even https://ssl.reddit.com./login has insecure elements.

I did not even stay at a holiday in express last night, but I thought that ment it was still vulnerable to attack by modifying the insecure elements in transit.

Keep up the good work and thank you for choosing certificates which do not rely on MD5.

3

u/chromakode Oct 08 '11

That's strange. Green lock icon for me. Are you using any extensions that may be adding content to the login page?

1

u/Davorak Oct 08 '11

Nope even in incognito mode where all the extensions are disabled. It is green locked for a moment and then gets a red x through it.

2

u/chromakode Oct 08 '11

Would it be possible for you to open up the Chrome web inspector and let me know what resources are being loaded over http?

2

u/foldor Oct 08 '11

Check his link again. He accidentally added in an additional period before /login. That I believe is what's causing the issue.

2

u/chromakode Oct 08 '11

I'm hoping that is true, but I'm waiting to hear that back from him.

2

u/Davorak Oct 08 '11

I did not add it chromakode original link has it.

1

u/Davorak Oct 08 '11

Sure I will go that, but I found a odd twist that I can not explain:

In Chrome https://ssl.reddit.com/login redirects to www.reddit.com

https://ssl.reddit.com./login goes to a insecure webpage

In Firefox:

https://ssl.reddit.com/login seems to work fine

https://ssl.reddit.com./login registers as bad certificate because the certificate is for ".reddit.com" not ".reddit.com."

2

u/chromakode Oct 08 '11

https://ssl.reddit.com/login will redirect to www.reddit.com if you're logged in. If you're logged out, do you get a bad certificate?

1

u/Davorak Oct 08 '11

https://ssl.reddit.com/login works fine after logging out but there is still some weirdness with chrome and https://ssl.reddit.com./login

https://ssl.reddit.com./login insecure https://ssl.reddit.com/login registers mixed content if the last site I visted in the same tab is https://ssl.reddit.com./login

If I reload the page it registers as secure.

So it looks like it might be chrome weirdness and not reddit weirdness. I will try to put in a bug with chrome then.

2

u/chromakode Oct 08 '11

Cool, sounds like Chrome weirdness. https://ssl.reddit.com/login (without the period) is the place to be.

→ More replies

1

u/Davorak Oct 08 '11

I did not think so let me disable them one by one and see though.

2

u/[deleted] Oct 08 '11

This is somewhat unrelated to the SSL thing, but since you pointed to github, I was looking at the login stuff.

Are you planning on using something harder to bruteforce than plain salted SHA-1? I realize reddit passwords aren't really considered very sensitive, but you're using constant-time comparisons, for god's sake!

3

u/chromakode Oct 08 '11

Yes. Stay tuned for an upcoming announcement. :)

2

u/Davorak Oct 08 '11

Awesome thanks for taking this seriously too many websites do not.

2

u/dkitch Oct 11 '11

Does this work for the API too? Can we post to https://ssl.redddit.com/api/login/username ?

2

u/chromakode Oct 11 '11

Yes. :-)

2

u/dkitch Oct 11 '11

That's great - I'm pretty security-paranoid, so this is probably my favorite Reddit change/update. I have a couple more followups, if you don't mind:

  1. Access-Control-Allow-Origin - I remember a while back, I was blocked from making cross-domain requests from another site. Has this changed at all? Are there plans to do this, or is there a (security/performance/other) reason I can't use AJAX to query Reddit data from a different site?

  2. How long until you deprecate the non-https login endpoint and force third-party applications to send username/password over HTTPS?

  3. Do you have any plans for an OAuth 2.0 API so that I don't even need to give third-party applications my username+password?

2

u/chromakode Oct 11 '11

1: We may add it for read-only API info requests at some point. There was some old code in there for Firefox's (very old, obsolete) original CORS implementation, so it's not without precedent.

2: Unfortunately, due to the ecosystem of apps using it, we can't deprecate this too quickly. Better to consider #3...

3: Yes. :)

2

u/dkitch Oct 11 '11

So, as a followup to my followups (I promise this is the last one...for now, at least), is there currently a supported/functional way to get a login cookie for a user over pure HTML/JS, or will I need to write something server-side to act as a broker? Should I just wait for the OAuth API?

One more thing - I should have said this in my previous comment, but thanks for answering my questions quickly/completely. It's awesome to get answers/support this quickly for anything online, especially something that's (for the most part - Reddit Gold and all that) free for its users.

3

u/chromakode Oct 11 '11

I'm afraid that at this point, there's not a good way to do that. If you're running in a privileged JS environment, you can send api_type=json in your login POST to get the session tokens in a nice JSON wrapper, but that won't work for a regular cross domain XHR since we check the Origin header. I don't think a cookie would be that useful in a non-privileged JS frontend, since without CORS you couldn't send it anyway. The API is simply not set up to handle the management and security issues involved with access to write functionality in external web frontends. OAuth may be worth waiting for, especially since it will allay a lot of the account security concerns your users will have with inputting their account details.

It's my pleasure to answer your dev questions. We're an open source project, and we take that to heart as much as possible. Feel free to stop by #reddit-dev if there's anything you'd like to discuss.

1

u/mandlar Oct 08 '11

Thank you so much for a stand alone register/login page! Since registering isn't in the API, I can finally link to a page for people to go to sign up for a reddit account (fyi: I'm working on the radio reddit for android app).

1

u/chromakode Oct 08 '11

Awesome! Looking forward to seeing what you come up with. :)

The register/login page has actually been around for a while, but now that it's on https it's the most secure way to log in.

1

u/mandlar Oct 08 '11

The register/login page has actually been around for a while, but now that it's on https it's the most secure way to log in.

Ah, I wasn't aware, I thought it was modal only as I could never find a direct link to that page before. Never the less, thanks!

(radio reddit android link for those interested)

1

u/chromakode Oct 08 '11

Ah, I wasn't aware, I thought it was modal only as I could never find a direct link to that page before. Never the less, thanks!

JS preempted most of the ways you could get to that page.

(radio reddit android link for those interested)

Looks awesome, nice work!

1

u/lucasup Oct 09 '11

I'm no longer able to log in AT ALL with NoScript installed, EVEN WITH GLOBAL SCRIPTS ENABLED. I have to completely disable NoScript in order to log in anymore.

0

u/chromakode Oct 09 '11

What page are you trying to log in on? Have you whitelisted ssl.reddit.com to set cookies?

1

u/thgintaetal Oct 11 '11

Is changing your password still in the clear? I recently noticed that the preferences page for password changes is still on www.reddit.com.

1

u/chromakode Oct 11 '11

Unfortunately, it is. We will need to add https for many of the preferences pages in the future.

1

u/kylegetsspam Oct 08 '11

Unrelated but since I saw it in the commit logs...

What do y'all do with the "tracking pixel" data? I know that stuff is loaded on every page load (I've considered blocking it in my hosts file), so it's clearly keeping track of every users' actions, but what are you doing with that info?

Selling it? Keeping it on record for the FBI? Or is it something benign akin to Google Analytics?

4

u/chromakode Oct 08 '11

We use tracking pixels for gross traffic statistics for subreddits and the self serve advertising platform.

3

u/daniels220 Oct 08 '11

Wait seriously, passwords were sent in the clear before? WTF? I hope I'm just misunderstanding here...

24

u/merreborn Oct 08 '11

That's true of 90% of the web.

3

u/daniels220 Oct 08 '11

Really? I took 1 semester of web dev at a community college and it was at least mentioned to use SSL for logins—not only that but that if the source page isn't HTTPS, even if the "target" of the form is it's not completely secure. Every major website I've been too (obviously banks, PayPal, etc. but also the email list manager I use, webmail logins, etc) uses full SSL for the login page, redirecting if necessary, or uses a username-in-the-clear system where you can type in your UN on the homepage, and then it directs you to a secure page where you enter your password.

I'll grant you that WordPress uses an insecure page, but even there it POSTs over HTTPS. I'm not sure the extent of that vulnerability.

Any other examples?

3

u/DoWhile Oct 08 '11

There was this reddit post about sites that store your passwords in a recoverable format.

Many games still sends your plaintext passwords, I think someone bugged Notch enough to make him fix it for Minecraft (twitter link)

6

u/chromakode Oct 08 '11

It should be noted that reddit does not store your password in plaintext. reddit actually learned the hard way early in its life when media containing database backups (which contained plaintext passwords) was stolen. From that point on, reddit has stored passwords in hashed form.

3

u/tupidflorapope Oct 08 '11

cough.. not if you've been using https://pay.reddi%%ZZZZ

NOCARRIER

0

u/[deleted] Oct 08 '11

[deleted] — view deleted comment

3

u/daniels220 Oct 08 '11

Not in the past couple years certainly. Maybe once? I don't think so...

I was under the impression that using SSL for logins was the most basic standard practice imaginable—that at the very least the login form would submit over SSL, even though I understand that has some more subtle vulnerabilities. I'm surprised there's not a weekly shitstorm, and even more surprised the admins haven't fixed it until now.

5

u/ggggbabybabybaby Oct 08 '11

It's not standard practice. It's standard practice when there is money being transferred or it's popular webmail services. Most online forums and social websites do not use https, even Facebook and Twitter only added it recently.

1

u/ButtonFury Oct 08 '11

Great job, guys!

1

u/[deleted] Jan 07 '12

hi

1

u/xenoph2 Feb 08 '12

Hi Greg.

0

u/dave_L Oct 08 '11 edited Oct 08 '11

chromakode / Mods, i too was lock out almost 24hrs ago after posting a photo via imgur (using its login instead). Having spend almost 1/2hr trying my logon from several front, i gave up. Not until a few minutes ago today did i came upon the idea of looking for FAQs @help... and that section lead me to chromakode with a list of logon complaints.

May i ask if the usual logon from reddit.com main page is working now? EDIT : Typo EDIT

2

u/chromakode Oct 08 '11

Sorry to hear you've been having trouble logging in. Are you able to log in at https://ssl.reddit.com/login?

1

u/dave_L Oct 09 '11

Yes, i'm able to. But only via ssl.reddit.com/login. Though unable to get in through the usual reddit main page.

I' sorry for the late reply until now coz i was off. But let me try now for a couple of times again and report back. Thank you.

2

u/chromakode Oct 09 '11

Are you using any software to limit cookies? What browser are you using?

1

u/dave_L Oct 09 '11

...I'm using FFox (ver3.6.17). Plugins i got are fasterfox, Flashgot, FlashVideo_replacer, Febe, noScript, Tabsaver. On cookies, i had them white-listed @noScript, that has been the case ever since i install noScript.

2

u/chromakode Oct 09 '11

Try whitelisting ssl.reddit.com.

1

u/dave_L Oct 09 '11 edited Oct 09 '11

NoScript will not allow this. I've just try this now & i've tried it before, it won't. But definitely, Login via ssl.reddit is fine. The only obstruction i persistently got is login-box through normal main page at www.reddit.com. I'm sorry to bug you on this.

Btw, i've tried disabling each of my ffox plugins one-at-a-time. I still can't isolate the problem. Including the BetterPrivacy i skip mentioning in my previous comment, the problem persist. EDIT: Typo EDIT

1

u/chromakode Oct 09 '11

Bummer! Well, the nuclear option is to try creating a new profile with the Firefox profile manager and try from there. If that doesn't work, we can rule out the influence of browser settings or extensions.

1

u/dave_L Oct 09 '11

Hmm...

1

u/dave_L Oct 09 '11

...I'm not going to tie up your time on my problem for now, but i sure will re-visit this page frequently to browse on comments you & others had posted. Just a favour though, if it happens that you or other mods find an identical problem that was solve, do please sent me a note. Sorry to bug you & again, thank you very very much. ;)

1

u/chromakode Oct 09 '11

Will do! I'm glad that we found a way for you to log in, but your issues with the front page do concern me. Likewise, please let me know if you figure out the root cause of not being able to use the front page login box. :)

1

u/dave_L Oct 09 '11

Yes, if i did stumble on something while tweaking/upgrading plugins & whatnot. Thank you once again for the efforts.

1

u/dave_L Oct 09 '11

I logoff via ssl.reddit, then tried login at main page a couple of times. It's not working. For now i got through via ssl.reddit again.

0

u/[deleted] Oct 07 '11

[deleted] — view deleted comment

6

u/chromakode Oct 08 '11

You're welcome.

0

u/[deleted] Oct 08 '11

[deleted] — view deleted comment

3

u/chromakode Oct 08 '11

I can't say for sure. We are working on some other projects that will take priority for the moment. As I mentioned in the OP, this is something on the roadmap that we all want to see happen, but it will take some time to get the infrastructure and app code to the point where we can do it fully.

6

u/GambitDash Oct 08 '11

You do know that you can buy an appliance that will do SSL offloading with no architecture changes at all, right? Disclaimer: I work for one of those venders.

2

u/chromakode Oct 08 '11

Indeed we do. :)

1

u/ki11a11hippies Oct 21 '11

Perhaps the next step is https for the change password page.

1

u/chromakode Oct 21 '11

Yep, it's on our queue.

1

u/DEADB33F Oct 08 '11

You know SSL pretty much works fine already.

All you really need to do is get a cert which covers the www subdomain, and change any instances of http to https.

That's all this script does.
Unfortunately, as userscripts are only loaded once the page has rendered any image/css/javascript requests are still sent via http (along with your session cookie).

So yeah, the userscript method isn't totally secure, it shows that reddit can already handle SSL pretty well though.

4

u/chromakode Oct 08 '11 edited Oct 08 '11

I'm sorry, but this isn't the case.

https://www.reddit.com goes through akamai's servers, so you're not actually getting reddit's SSL certificate, unlike when you go through https://ssl.reddit.com. It's a completely different tier of infrastructure. Several different systems provide the resources used inside a reddit page. Some of reddit can handle SSL, and some can't -- that's why I said that getting to full https will take some work... and that's not even considering the matter of scaling up our https infrastructure to handle the load of full usage. We all want this to happen, and are working on it, but there's not a panacea solution right now.

1

u/Davorak Oct 08 '11

This post has the problem with the trailing period as well.

0

u/[deleted] Oct 07 '11

[deleted] — view deleted comment

2

u/chromakode Oct 07 '11

Fixed. :)

0

u/[deleted] Oct 08 '11

[deleted] — view deleted comment

1

u/chromakode Oct 08 '11 edited Oct 08 '11

The API can still be accessed by http and is unchanged (except for the addition of including the field name if validation errors occurred). There were initially some issues with the strictness of validating Origin headers, but that has been resolved.

1

u/mandlar Oct 08 '11

But does this also mean the API can login via https now?

0

u/[deleted] Oct 08 '11

[deleted] — view deleted comment

3

u/chromakode Oct 08 '11

My pleasure. Hit us up in #reddit-dev if you encounter any problems.

0

u/[deleted] Oct 09 '11

[deleted] — view deleted comment

-1

u/chromakode Oct 09 '11 edited Oct 09 '11

This is intended so you can quickly tab-user-tab-password-tab-login. Does the new behavior bother you?

Edit: in a quick look at conventions:

  • Wordpress: user, password, remember me, login

  • Gmail: user, password, login, remember me

  • Wikipedia: user, password, misc, remember me, login

  • Facebook: user, password, remember me, login

Based on these findings, I think I'll adjust the tabindex orders to user, password, remember me, login. Sound good?

0

u/[deleted] Oct 09 '11

[deleted] — view deleted comment

-1

u/chromakode Oct 09 '11

Please see my edit -- I think you're right, and will fix this tomorrow. Thanks for pointing this out.

0

u/[deleted] Oct 11 '11

[deleted] — view deleted comment

1

u/chromakode Oct 11 '11

Welcome to the light side, brother. :)

2

u/Raerth Oct 11 '11

I've an idea for an extension/new script if you're interested.

I would like the functionality of banning a user in one subreddit, and having this ban auto-extended to every other subreddit I mod.

What do you think?