edelweis Posted October 27, 2012 at 06:37 PM Report Share Posted October 27, 2012 at 06:37 PM [Edited] When connecting to chinesetesting.cn, for instance to register for an HSK test, the connection is unsecured, so anyone spying on the network can see not only your username and password, but also your detailed identity information (full name, birth day, address, passport number...). (I had a moment of incredulity and thought "perhaps they use some kind of Javascript encryption method that does not show as https". Nope, I checked, all data in the clear.) At the very least I advise everyone to avoid using that website over a wireless connection, to avoid tempting hobbyist hackers. But serious hackers can spy even on physical wire, so the probability of identity theft is not null however you connect. (And, I am aware that even https is not absolute protection, but at least it can deter some of the would-be hackers.) What to do about this? Has anyone contacted the HSK organizers in China before? I was thinking we could massively send polite messages to Hanban requesting they change their website to secure both the individual applicant and the testing center staff interfaces of course, plus any correcting/administrative staff interfaces. Quote Link to comment Share on other sites More sharing options...
Daan Posted October 28, 2012 at 10:15 AM Report Share Posted October 28, 2012 at 10:15 AM Because JavaScript runs client-side only (except node.js, of course), there's no safe JavaScript encryption, and even more so when a third party can read the data being sent over the network. Like you said, Hanban needs to implement HTTPS, which is pretty much 100% secure as long as they use a key that's long enough. It's not hard to implement HTTPS either, but somehow I think that trying to get Hanban to switch to HTTPS is going to be harder than getting a perfect score on the HSK... Quote Link to comment Share on other sites More sharing options...
edelweis Posted October 29, 2012 at 05:28 PM Author Report Share Posted October 29, 2012 at 05:28 PM I'm afraid you are right, Hanban will probably be difficult to move... Sooner or later there will be a big scandal... Quote Link to comment Share on other sites More sharing options...
acatt Posted October 30, 2012 at 03:50 AM Report Share Posted October 30, 2012 at 03:50 AM That's how I got my score on the HSK... Quote Link to comment Share on other sites More sharing options...
edelweis Posted October 31, 2012 at 05:36 PM Author Report Share Posted October 31, 2012 at 05:36 PM That's also how you registered for HSK. If you didn't do it yourself, the testing center did it for you, and I'd bet the web page they use isn't secured either... (in addition to the paper application itself which the testing center might not shred before throwing away). Quote Link to comment Share on other sites More sharing options...
Erbse Posted December 28, 2012 at 04:28 PM Report Share Posted December 28, 2012 at 04:28 PM A lot of companies work like this: Ignore user safety until a scandal hits. Normally I avoid such companies, but there aren't that much alternatives to HSK if you need a HSK certificate. Quote Link to comment Share on other sites More sharing options...
edelweis Posted December 28, 2012 at 10:26 PM Author Report Share Posted December 28, 2012 at 10:26 PM True. I have been looking at alternate tests, however I have not checked whether they take privacy seriously or not. There's the Taiwan test (former TOP), and now the French government has launched a practical test of Chinese (among other languages) which is supposed to be graded according to CEFR levels... but I think it has been offered only once so far for Chinese learners. Quote Link to comment Share on other sites More sharing options...
roddy Posted December 28, 2012 at 11:39 PM Report Share Posted December 28, 2012 at 11:39 PM In 2009 I tried to get Hanban to stop linking to the 2007 HSK schedule, with no success. Good luck on getting them to fix this... To be honest, given the number of landlords, property agents, hotel receptionists and visa agents that already have that info, and in some cases high quality scans of my passport, I'm not sure I'd let it stop me taking the exam, if I was planning to. Quote Link to comment Share on other sites More sharing options...
Wicked Posted January 9, 2013 at 12:20 AM Report Share Posted January 9, 2013 at 12:20 AM Is there any other way to register for the HSK? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and select your username and password later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.