Why is login to these forums not defaulted to HTTPS? <eom>

Jack of Diamonds

sr. member

Activity: 252

Merit: 251

Quote from: wumpus on July 08, 2011, 01:14:54 PM

Quote from: CanaryInTheMine on July 08, 2011, 11:20:45 AM

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

+1
no excuses, this is a cryptocurrency forum for fuck's sake, we need security by default, not after someone has exploited it already

Best one line post since the forum's inception. And true.

Why does everything need to be utterly broken before it's fixed and someone admits 'more could've been done' after the fact?

The worst should be assumed always, 24/7.
That's not pessimism, that's realism and that's how the world works. Weakness will be always exploited.

Smalleyster

member

Activity: 84

Merit: 10

I yam what I yam. - Popeye

Quote from: wumpus on July 08, 2011, 01:14:54 PM

Quote from: CanaryInTheMine on July 08, 2011, 11:20:45 AM

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

+1
no excuses, this is a cryptocurrency forum for fuck's sake, we need security by default, not after someone has exploited it already

/aol on

Me too!

/aol off

wumpus

hero member

Activity: 812

Merit: 1022

No Maps for These Territories

Quote from: CanaryInTheMine on July 08, 2011, 11:20:45 AM

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

+1
no excuses, this is a cryptocurrency forum for fuck's sake, we need security by default, not after someone has exploited it already

drawoc

full member

Activity: 168

Merit: 100

Firstbits: 175wn

Just to be clear to everyone reading this thread, you can already browse the forums with SSL. In the URL bar, simply add an s on the end of http, and you'll be good (Yes, they already have a cert).

The OP is about making this the default, not about adding SSL support.

CanaryInTheMine

donator

Activity: 2352

Merit: 1060

between a rock and a block!

Quote from: joepie91 on July 08, 2011, 11:26:22 AM

Quote from: CanaryInTheMine on July 08, 2011, 11:20:45 AM

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

I don't think people are specifically arguing against SSL, but rather arguing against making it the default.

Whatever... Just make it happen please. Let us know how we can help. Thanks.

joepie91

sr. member

Activity: 294

Merit: 250

Quote from: CanaryInTheMine on July 08, 2011, 11:20:45 AM

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

I don't think people are specifically arguing against SSL, but rather arguing against making it the default.

CanaryInTheMine

donator

Activity: 2352

Merit: 1060

between a rock and a block!

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

joepie91

sr. member

Activity: 294

Merit: 250

Quote from: CanaryInTheMine on July 08, 2011, 02:43:17 AM

Quote from: theymos on July 08, 2011, 01:47:48 AM

HTTPS might increase load too much for the server to handle.

The cookies also need to be made secure. Right now you'll send them over an insecure connection if you ever visit any HTTP page even if you use HTTPS normally.

Properly configured servers won't have any issues with SSL. Poor excuse.

SSL does actually cause extra server load, even if it's just a little. For something that is under DDoS rather often (like these forums) that may be a dealbreaker.

XIU

member

Activity: 84

Merit: 10

It does support running the forum on https, or will the login explicitly go to the http page first?

wumpus

hero member

Activity: 812

Merit: 1022

No Maps for These Territories

Quote from: theymos on July 08, 2011, 01:47:48 AM

HTTPS might increase load too much for the server to handle.

You could try it out, though. I don't think the difference will be significant. Most of the work a forum server does is not related to the network but to database I/O, and secondly PHP logic generating the pages.

Others, about the certificate: you don't need to "chip in" as there is already a proper certificate now. It was a problem of the past.

CanaryInTheMine

donator

Activity: 2352

Merit: 1060

between a rock and a block!

Quote from: theymos on July 08, 2011, 01:47:48 AM

HTTPS might increase load too much for the server to handle.

The cookies also need to be made secure. Right now you'll send them over an insecure connection if you ever visit any HTTP page even if you use HTTPS normally.

Properly configured servers won't have any issues with SSL. Poor excuse.

theymos

administrator

Activity: 5166

Merit: 12850

HTTPS might increase load too much for the server to handle.

The cookies also need to be made secure. Right now you'll send them over an insecure connection if you ever visit any HTTP page even if you use HTTPS normally.

CanaryInTheMine

donator

Activity: 2352

Merit: 1060

between a rock and a block!

Quote from: fitty on July 07, 2011, 11:55:28 PM

Quote from: CanaryInTheMine on July 07, 2011, 08:00:57 PM

With all the shenanigans with exchanges and DDOS against pools, it's only a matter of time till the forums fall victim to something...
Would SSL by default help avoid "some" problems? Probably.

A cert is very inexpensive nowdays. I'm sure ppl would chip in for this purpose if we were asked to do so.

Chip in? You realize the people who started BTC have 100,000s of BTC right? Wildcard cert is like $200.

So what? If the call came, ppl would chip in. Or you can lobby these people you are talking about to pay for it. Go for it!

fitty

hero member

Activity: 728

Merit: 501

CryptoTalk.Org - Get Paid for every Post!

Quote from: CanaryInTheMine on July 07, 2011, 08:00:57 PM

With all the shenanigans with exchanges and DDOS against pools, it's only a matter of time till the forums fall victim to something...
Would SSL by default help avoid "some" problems? Probably.

A cert is very inexpensive nowdays. I'm sure ppl would chip in for this purpose if we were asked to do so.

Chip in? You realize the people who started BTC have 100,000s of BTC right? Wildcard cert is like $200.

Veldy

member

Activity: 98

Merit: 10

Quote from: CanaryInTheMine on July 07, 2011, 08:00:57 PM

With all the shenanigans with exchanges and DDOS against pools, it's only a matter of time till the forums fall victim to something...
Would SSL by default help avoid "some" problems? Probably.

A cert is very inexpensive nowdays. I'm sure ppl would chip in for this purpose if we were asked to do so.

It keeps your credentials encrypted at least which makes man in the middle attacks essentially not possible [I suppose if they have the certificate and somehow change DNS records ...].

CanaryInTheMine

donator

Activity: 2352

Merit: 1060

between a rock and a block!

With all the shenanigans with exchanges and DDOS against pools, it's only a matter of time till the forums fall victim to something...
Would SSL by default help avoid "some" problems? Probably.

A cert is very inexpensive nowdays. I'm sure ppl would chip in for this purpose if we were asked to do so.

wumpus

hero member

Activity: 812

Merit: 1022

No Maps for These Territories

+1

I don't really understand why it still supports plaintext http at all. The only use for http servers is to redirect to https

The reason for this used to be because the forum used a self-signed certificate that produced scary warnings in some browsers. This was solved a while ago, though, and we could easily go full https.

josephholsten

newbie

Activity: 18

Merit: 0

+1

Veldy

member

Activity: 98

Merit: 10

Topic: Why is login to these forums not defaulted to HTTPS? <eom> (Read 1914 times)