Any site viewed over plain HTTP is susceptible to content injection by ISPs, public wifi providers, employers, etc, basically anyone between you and the server. At best it's annoying, at worst it's a security hazard.
And as someone else mentioned, the session cookie is still transmitted in plaintext, which effectively compromises your Feedly account.
Not to be too glib about it, but for God's sake, who cares? It's my Feedly account. It holds my read/unread status for my daily newsfeeds. What's the big hacker target here? Spoofing that I've already read Hacker News today? Subscribing me to feeds I don't want? I encourage Feedly not to waste time securing that on my behalf.
Comments
Security? Where do you see security issues outside of login data (which is already over HTTPS)?
This seems like a privacy feature (something not necessarily everyone cares about when it comes to their feedreading), not security.
How do you think the authenticated session is maintained?
Any site viewed over plain HTTP is susceptible to content injection by ISPs, public wifi providers, employers, etc, basically anyone between you and the server. At best it's annoying, at worst it's a security hazard.
And as someone else mentioned, the session cookie is still transmitted in plaintext, which effectively compromises your Feedly account.
Not to be too glib about it, but for God's sake, who cares? It's my Feedly account. It holds my read/unread status for my daily newsfeeds. What's the big hacker target here? Spoofing that I've already read Hacker News today? Subscribing me to feeds I don't want? I encourage Feedly not to waste time securing that on my behalf.
Don't want the NSA reading my I can haz cheezburger feed
They've got the certificates so they'll see your lolcats either way.