Jungle Disk support sends login credentials over http

3 pointsnoja3 comments

I noticed today that Jungle Disk uses SSL. A lot. And passphrases and encryption too. Which is good.

Until you need to use support. Their support site sends your username and password over plain old http, no SSL involved. Try it: http://support.jungledisk.com/

A truly facepalming moment.

View on HN

It POSTs to a secure page. Same as many sites including facebook.com

That's better, but it doesn't solve the problem: the username and password must be entered on a page that has been potentially modified in transit.

Jungle Disk support here... While we investigate further, we welcome you to email your request to support@jungledisk.com, circumventing the need to provide a username and password. Thanks for your understanding.

Reply on news.ycombinator.com