pglombardo/PasswordPusher — pull request #16 by pglombardo (2013-07-03 18:35:52+00:00)
Title: PwPush.com Lacks Transport Security

Allowing passwords to be transmitted over HTTP greatly degrades any potential security benefits offered by PwPush as an email password delivery replacement.

PwPush.com should *require SSL* and *enforce its use client-side*. Presently SSL is offered, but it is not the default transport mechanism nor enforced via redirect & strict transport policy. See https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Secure_Server_Design as one reference for best practices.

Additionally, the current SSL deployment on PwPush.com loads mixed content, generating a warning in browsers. The culprit seems to be a Google Web Font fetched over HTTP (http://fonts.googleapis.com/css?family=PT+Mono)