EVE Information Portal

For people that don't:


Logins on websites are managed by session cookies (generally these cookies also have the duration of a session.), which identify the session on the server. If different servers are handling the applications, they each need their own session cookie.

Thus, each needs you to log in.

Now, with the use of SSO, you sign into the login.eveonline.com server, and, if you tick the remember me box, it drops a cookie on your web browser, which identifies you the next time you come round (when you try logging into a different application) and removes the requirement to log in again.

Just the nitpicky side in me, but, how about upgrading the SSL cert so that it shows who owns it, right in the browser?

Paypal does this, for example, helps differentiate paypal from fakers much more easily than having to click the cert, and wading through it's information.

nom nom nom

I do understand that it is usefull for some. Is there however a way to disable sso for all sites except the eve sites from ccp?
I have a very nasty habbit not to trust any other site. Maybe that has something to with my day job. I test software for a rather big organisation. About 30k employees

Btw I have 15 different passwords for 15 different sites. And I don't use a program to manage that.

While any encryption may better than plaintext, using RC4 is considered insecure. RC4 is only acceptable as backup for WinXP Internet Explorer Users -and even that is questionable. RC4 is a no go under normal circumstances.
You may want to review https://www.ssllabs.com/ssltest/analyze.html?d=login.eveonline.com
The supported TLS_RSA_WITH_AES_xxx_CBC_SHA is the absolute minimum I would use today and acceptable for now -but not more than hat.
Although, TLS 1.2 with ECDHE cipher-suites (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 for example) would be much better since they also provide forward secrecy.
Unfortunately, the 2 RC4-Ciphers are prefered by server over the more secure AES-Ciphers:

Cipher Suites (SSL 3+ suites in server-preferred order, then SSL 2 suites where used)

• TLS_RSA_WITH_RC4_128_SHA (0x5) 128 <- probably your current connection
• TLS_RSA_WITH_RC4_128_MD5 (0x4) 128
• TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
• TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128

One might ask now: It's just EVE... not online banking... why bother with security hardening?
Because SSL-Tweaking takes not much time. In fact on most server it's done in a few minutes -assuming you actually do your server-maintenance and keep the software up to date.

Consequently, if you see RC4 in your browsers connection-security window, your data is not secure. Not because someone is going to crack your connection, but because the admin has very likely no idea about properly securing a webserver.

On another note: Enabling HSTS for Login.eveonline.com might be a good idea as well.

You'll always have to click through (for character selection), and until you do, nothing gets sent to the site. (when you do, all the site gets is your character id and name, along with a hash to uniquely identify the combination of character and account. Sell the character, and it changes. No way to identify the account, just that it's changed.)

You're picturing a naughty site using the real CCP SSO page. The anughty site won't get any useful information until you pick the character, and even then the information isn't that useful. It would be much more effective to have a naughty site using a fake CCP SSO page.

How many people are going to check the domain and validate the certificate and all that?

For Luddites like myself, will we still be able to log onto the Eve site as we do today, or are we being forced to use this SSO nonsense?

no way. no way he's for real

As long as I can log on the same way as I do today, without any more hoop-jumping, and without providing more personal information (love how many sites now require your facebook account to log on), I am fine.