I just noticed this morning that the site was just plain HTTP, and credentials were being sent in clear text. You can't even navigate the site via HTTPS, as the webservers aren't even configured to support it.
What does this mean for the average user? If you log in to any of the Bimmerpost sites on a public wifi connection, it is trivially easy for someone to read your login credentials over the air. I'm not overstating this. Your average 14 year old can Google how to do this and have it figured out in 15 minutes.
Why is this a problem? Only 22% of us use different passwords for each site. The other 78% reuse passwords across sites, which means their bimmerpost password is the same as at least one of their other accounts and many people use the same password for nearly every site.
Guys, a legitimate SSL certificate costs
literally $0 via
LetsEncrypt. This is a legitimate, trusted certificate authority structed as a 501(c)(3) non-profit and backed by huge industry names like:
- The Linux Foundation
- Mozilla (the Firefox people)
- Chrome (the web browser that more than 60% of people use worldwide)
- Akamai (the world leader in content delivery)
- Cisco
- Electronic Frontier Foundation
- The Ford Foundation
- Facebook
There is no reason to not be doing some type of SSL encryption. Hell, a lack of SSL (https) has a negative effect on your rankings in Google search results now. Browsers have already started showing sites without SSL as "not secure", and is expected to
step up this warning in the near future.
There are
hundreds of
pages that explain
why HTTPS should be enabled whenever
possible.
If this hasn't been done due to a lack of resources, I'd be happy to assist setting this up pro bono and under an NDA. If you want a copy of my resume, let me know.