# Not using HTTPS? **URL:** \ **Category:** YoYoExpert Site Improvements\ **Created:** [July 19, 2014, 10:56am UTC](https://forums.yoyoexpert.com/t/not-using-https/67883 "2014-07-19T10:56:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Espionage724](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/espionage724/32/1501_2.png) [@Espionage724](https://forums.yoyoexpert.com/u/Espionage724)\ **Post date:** [July 19, 2014, 10:56am UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/1 "2014-07-19T10:56:01Z")
Was messing with some pretty basic session hijacking and password sniffing (basic as in using a freely available Android app), and was surprised at how easy it was to get my own username and password on my network. This can easily be extended to others on my network too (as in, I can session hijack and get the username/passwords of people who do anything on this site on my network), and can even be done on other networks too with ease. To be fair though, this would likely be possible with any site that doesn’t use https for authentication, but I don’t know too many sites nowadays that don’t. Should also note that I don’t specialize in network penetration at all, so the above is pretty basic/beginner-tier (generally speaking). > [@](#): > > We take precautions to protect your information. When you submit sensitive information via the website, your information is protected both online and offline. That was taken from [http://yoyoexpert.com/privacy-statement.html](http://yoyoexpert.com/privacy-statement.html) but when I can get personal information from such basic tools, I really don’t think there’s much “precautions” going on. ---
**Author:** ![crococorey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/crococorey/32/1380_2.png) [@crococorey](https://forums.yoyoexpert.com/u/crococorey)\ **Post date:** [July 19, 2014, 2:08pm UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/2 "2014-07-19T14:08:22Z")
Good thing it’s just a yoyo forum. Edit: Whoops sorry I think I misunderstood the thread. ---
**Author:** ![CaliBuddha](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/calibuddha/32/156_2.png) [@CaliBuddha](https://forums.yoyoexpert.com/u/CaliBuddha)\ **Post date:** [July 19, 2014, 2:10pm UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/3 "2014-07-19T14:10:03Z")
> [@crococorey](#): > > Good thing it’s just a yoyo forum. That is irrelevant. ---
**Author:** ![LinksLegionaire](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/linkslegionaire/32/886_2.png) [@LinksLegionaire](https://forums.yoyoexpert.com/u/LinksLegionaire)\ **Post date:** [July 19, 2014, 3:07pm UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/4 "2014-07-19T15:07:36Z")
I think the key phrase here is, “on my network”. ---
**Author:** ![GregP](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/gregp/32/1192_2.png) [@GregP](https://forums.yoyoexpert.com/u/GregP)\ **Post date:** [July 19, 2014, 3:29pm UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/5 "2014-07-19T15:29:44Z")
> [@LinksLegionaire](#): > > I think the key phrase here is, “on my network”. It is, but I suppose you could be on a shared network at a coffee shop or something, so it’s still a security concern. I _personally_ still don’t get too bothered, though. Someone creating a middle-man attack has better targets than a person’s yoyo forum account. ---
**Author:** ![Espionage724](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/espionage724/32/1501_2.png) [@Espionage724](https://forums.yoyoexpert.com/u/Espionage724)\ **Post date:** [July 20, 2014, 4:02am UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/6 "2014-07-20T04:02:25Z")
> [@LinksLegionaire](#): > > I think the key phrase here is, “on my network”. I only tested it on my network, but in reality, it could work anywhere. I could connect to a public hotspot and start sniffing. As for what damage could be done; imagine being on the same network as a moderator. Anyone into causing some damage could have a bit of fun there. But at the very least, it’s a security concern, especially for people who don’t follow the “use a separate password for everything” rule. Fortunately it seems the shop actually uses separate login credentials though (from what I’ve seen anyway; someone who’s actually used it might want to chime in), along with using HTTPS. On the other hand, how many people who have a customer account use separate credentials from that of their forum account? ---
**Author:** ![Coronett](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.yoyoexpert.com/coronett/32/1393_2.png) [@Coronett](https://forums.yoyoexpert.com/u/Coronett)\ **Post date:** [July 30, 2014, 5:13pm UTC](https://forums.yoyoexpert.com/t/not-using-https/67883/7 "2014-07-30T17:13:10Z")
That free wifi at yoyo contests though. Anyways, just vpn it up.