Site unsecure at login warning ?

AliGorie

using Firefox on a Mac / Sierra I'm getting this warning @ password login - ?
described here -
https://support.mozilla.org/t5/Protect-your-privacy/Insecure-password-warning-in-Firefox/ta-p/27861

TTony

Slightly further down the page that you linked ...

About insecure pages

Pages that need to transmit private information, such as credit cards, personal information and passwords, need to have a secure connection to help prevent attackers from stealing your information. (Tip: A secure connection will have "HTTPS" in the address bar, along with a green lock icon.)

Pages that don’t transmit any private information can have an unencrypted connection (HTTP). It is not advised to enter private information, such as passwords, on a web page that shows HTTP in the address bar. The information you enter can be stolen over this insecure connection.

AliGorie

thanks TT

robinbowes

And you're submitting passwords over http, aren't you? I've brought this up before. Should really switch to https.

monquixote

Yep but the http linked images all over the site would trigger warnings all over the place unfortunately

robinbowes

Insist on https links. Better that warning than passwords over http, IMHO.

monquixote

robinbowes said:

Insist on https links. Better that warning than passwords over http, IMHO.

Unfortunately we need a time machine to fix that several years ago when the forum started.

digitalscream

robinbowes said:

Insist on https links. Better that warning than passwords over http, IMHO.

Yep. Broken Javascript, broken image links everywhere...that's much preferable to having a functional site.

We've been here before

robinbowes

Bah.

Strat_a_tat_tat

Surely... if the site is insecure... it just needs a few kind words of reassurance. Something to help boost its self esteem.

crunchman

Just changed my password.  My old password was used for some other sites.

robinbowes

https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html
https://blog.cloudflare.com/https-or-bust-chromes-plan-to-label-sites-as-not-secure/

digitalscream

robinbowes said:

https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html
https://blog.cloudflare.com/https-or-bust-chromes-plan-to-label-sites-as-not-secure/

Yes, I'm aware.

If you'd be so kind as to tell me which bits of the site to switch off in order to make it happen, it would be ever so helpful. I'm sure everyone can live without the text editor and just type HTML in the box, right?

robinbowes

Gosh, you're right. There are absolutely no working sites on the internet right now that have text editors.

digitalscream

robinbowes said:

Gosh, you're right. There are absolutely no working sites on the internet right now that have text editors.

Don't be a dick. *This* website, with its reliance on plugins which are coded by PHP monkeys rather than experts, relies on an editor which doesn't currently work with HTTPS. In fact, none of the editor plugins do except the stock one, which is broken in just about every other way.

I mean...I could just take the site down for a year or so while I rewrite everything properly. Do you think that would be useful to anyone?

robinbowes

So what is your plan? You can't just ignore it. It's not going to go away. It will all stop working some day soon. Then what?

digitalscream

robinbowes said:

So what is your plan? You can't just ignore it. It's not going to go away. It will all stop working some day soon. Then what?

I was actually just thinking of switching over to HTTPS and putting your email address on the front of the site for support queries, since you seem to think it's so simple :P

As I've said every single other time that you've brought it up, I'm working on it. It's nowhere near as simple as you appear to think it is, and this site is not the focus of my entire life. Therefore...it'll happen when it's done and working.

m_c

This argument was had on another forum I visit occasionally, and as somebody summed it up, what are hackers going to gain from hacking your forum account?

digitalscream

m_c said:

This argument was had on another forum I visit occasionally, and as somebody summed it up, what are hackers going to gain from hacking your forum account?

To be fair, most people use the same password everywhere - and thus if somebody manages to get a sniffer between you and the server, they can gain access to your other accounts. However, there are so many moving parts involved in doing so that it makes such attacks extremely effort-intensive for not a lot of gain; you can't harvest many passwords in a reasonable time frame that way, and it's usually more "sensible" to go straight for vulnerabilities in the server (or its software) itself.

As I said, this is not something I'm ignoring, I'm just fighting against a lot of extremely poorly-developed third-party code to try to make it work.

robinbowes

m_c said:

This argument was had on another forum I visit occasionally, and as somebody summed it up, what are hackers going to gain from hacking your forum account?

That's not particularly the point.

The issue is that at some stage relatively soon, browsers are going to stop working with http altogether.

R.

robinbowes

digitalscream said:

robinbowes said:

So what is your plan? You can't just ignore it. It's not going to go away. It will all stop working some day soon. Then what?

I was actually just thinking of switching over to HTTPS and putting your email address on the front of the site for support queries, since you seem to think it's so simple :P

As I've said every single other time that you've brought it up, I'm working on it. It's nowhere near as simple as you appear to think it is, and this site is not the focus of my entire life. Therefore...it'll happen when it's done and working.

Happy to help, if I can.

R.