Quote from: holorga on July 04, 2013, 08:16:20 AM

Quote from: LucasJones on April 05, 2013, 09:54:51 PM

Well, if someone was actually trying to steal from your Bitcoin Minefield account, it would not be too difficult.

It was assumed to be too unlikely that someone would try to steal from it. (As was mentioned before in this thread, there is no real security, just the secret key which is sent to the server unencrypted)

you are spreading disinformation and fear.
it is not unlikely that someone would try to steal from this site, a LOT of people try to steal bitcoin, everywhere.

a person that's in position to log in as you has to be in the same local network and with access to your traffic.
that same person is in position then to steal your facebook and gmail sessions too (login is encrypted but cookies are sent over plaintext connection afterwards)
do those sites offer no real security too?

I apologise, that was not my intent when I wrote the post.

I was referring to the fact that it would be relatively unlikely that someone would hack into your local network with the specific intent of gaining access to your bitcoin minefield account, although of course it is possible, especially with bitcoin exposure rising.

I said that it would not be too difficult for someone to gain access to your account if they were specifically trying to. If this was unclear I mean that if someone knew enough information about you, and had the knowledge to gain access to your private network (or was able to sniff packets some other way) they could get into your minefield account with relative ease (as the page isn't currently secured with ssl).

When you access a site through https (default on facebook, etc), all data except for the host you are requesting is encrypted. This means that all your cookies and other information is encrypted, making it difficult for someone sniffing on your network to gain access to your accounts. It is still possible for someone to gain access to these accounts through exploits such as MITM attacks, etc., but these usually take more effort, network access and knowledge than just sniffing packets.

If you think that network sniffing is a significant security concern, I encourage you to use https (if it would not be too much of a hassle) as it would encrypt the path of your site and the cookies sent, protecting the user's secret id from being found as easily.