fpl.ca is not using a https for password, is this safe?

[jackd]

I've been using FPL for a while and loved it. But just today, I noticed that the website of fpl is not using https for the login session. And I always use public wireless(public library, 3G) to access and set the follow me setting. Is this safe?
BTW can the SIP PW be changed easily, in case it's been exposed to hackers somehow?

[laurent]

No, it's not safe. Don't login to FPL if you're on a network you do not trust.

It's been discussed here http://forum.freephoneline.ca/viewtopic ... 893#p10755

The password can only be changed by special request. PM the admins or call support.

[jackd]

Thanks, have read your posts. Totally agree with you. all the info stored in here are important personal info enough to cause identity theft issue, not to mention it's associated with direct access to you sip settings. So a person can easily calling from your number along with all all the address info, It's pretty scary.

An encrypted login session should be in place to prevent such kind of security issues.This should be regarded as a problem.

[FONGO_kris]

SSL encryption for customer login has to wait until we can separate it from the rest of the website, since we obviously do not want to enable SSL over the entire website, only the login section. This will require a bit of time and dedication on our programmers part as they'll have to redesign a login page which incorporates both the general customer login but also the online purchasing page.

We will keep you updated with future developments, but currently the time needed is not available.

[zombie999]

since we obviously do not want to enable SSL over the entire website, only the login section.

Why not? E.g Vbuzzer has encryption on the whole site and no one is complaining about this. I hate them but at least they are doing that right from the beginning.

So is the password sent in plain text or as one-way-hash on the current FPL site?

[laurent]

So is the password sent in plain text or as one-way-hash on the current FPL site?

100% pure old-fashioned genuine plaintext, from my understanding of the code.