This site needs SSL encryption - https

P

Paul Folger

Member
I haven't used this site in awhile and was surprised to find that it isn't using SSL encryption. Presently this is only an http website which is more open to hacking. Any chance this will change soon?

Thanks
 
there is no need to use SSL on a site like this. What, in an open forum like this, do you need to encrypt?
Why is DVX likely to be a target?
 
Every site can be a target. Bots and meatbots hunt for insecure sites for fun and profit.

Here's what the makers of vBulletin (on which this fine forum runs) have to say (at least as of last update in May 2017):

CONVERTING YOUR FORUM TO HTTPS

This FAQ explains how to convert your vBulletin forum to use secure https (SSL) rather than http, and why you might need to.

[snip]

WHY DO I NEED HTTPS?
Data sent over regular http connections are sent in plain text and could in theory be read by anyone who intercepts the connection. With an https connection, the data is securely encrypted, meaning that even if someone intercepted it, they wouldn't be able to read it.
Starting in January 2017, Google's Chrome browser will begin to mark non-https pages as 'Insecure'. This warning may put off visitors to your site. Other browsers are expected to follow suit in due course.
More details on this can be found HERE
Additionally, Google is now using https as a ranking signal, meaning not having https could harm your site's ranking in Google. More details on this HERE.

Rest of the FAQ, with links and instructions can be found here:
https://www.vbulletin.com/forum/articles/4361080-converting-your-forum-to-https
 
Paul Folger said:
I haven't used this site in awhile and was surprised to find that it isn't using SSL encryption. Presently this is only an http website which is more open to hacking. Any chance this will change soon?

Thanks
Click to expand...

Yep, I'll add another voice asking for encryption. All web traffic should be encrypted.
 
HTTPS is less useful here because all it does is scramble the data transmission between you and the site. For example, you click a page, and the HTML coming from the site to you would be scrambled. Or you submit a post, and the text of your post is scrambled, so that an eavesdropper couldn't read your post.

But since www.dvxuser.com shows everything even to unsigned-in guests, what's the benefit? Your posts are signed and dated with your username, for all the world to see.

HTTPS doesn't protect a site from being broken into or hacked or whatever else scary stuff you can think of.

There would be one benefit though: when you sign in. Your password should be scrambled in transmission. DVXUser actually does this but with JavaScript instead of HTTPS, and with an older cipher, so it's not the safest thing in the world, and if you use the same password for DVXUser as you do with your bank, I would change your bank's password now.

The site owner should look into Let's Encrypt. It's free and easy (easy for a webmaster, not mere mortals).
 
The biggest benefit to going HTTPS is that Google Chrome will soon mark non HTTPS sites as explicitly not secure. It’s a good idea to just do it.

The Chrome deadline is July if I remember right.
 
jbregar said:
The biggest benefit to going HTTPS is that Google Chrome will soon mark non HTTPS sites as explicitly not secure. It’s a good idea to just do it.
The Chrome deadline is July if I remember right.
Click to expand...

Not really. Lots of people don't use chrome. Chrome is hardly secure in itself.
SSL can be defeated in near real time

So it is an improvement but not as much as you might think.
In some ways it is worse as it givers a false sence of security.
 
It is Google itself that will start to flag sites as non https. There is a push to make the entire internet https and eventually all browsers and search engines are going to ding sites that are not. The same goes for responsive. Google now hurts SEO on sites that are desktop only so many of our great posts no longer show up very well in search results. Both the lack of responsive and https are going to hurt this site.
 
Thomas Smet said:
It is Google itself that will start to flag sites as non https. There is a push to make the entire internet https and eventually all browsers and search engines are going to ding sites that are not. The same goes for responsive. Google now hurts SEO on sites that are desktop only so many of our great posts no longer show up very well in search results. Both the lack of responsive and https are going to hurt this site.
Click to expand...

I don't use google. neither do a growing list of people I work with

That said SSL doesn't hurt but it is not the remedy people think it is.
 
jagraphics said:
I don't use google. neither do a growing list of people I work with

That said SSL doesn't hurt but it is not the remedy people think it is.
Click to expand...

You don't use Google. That doesn't really change the fact that the OVERWHELMING majority of people on the Internet do use Google. A ton of them also use Google Chrome.

The fact is, SSL doesn't hurt anything and it does have tangible, real-world benefits.

- Google is starting to down-rank non-SSL sites
- Chrome is marking non-SSL sites as "insecure"
- Usernames and passwords are being sent in clear text. If you re-use your password elsewhere, it's a security risk... and a TON of people re-use passwords.

Getting SSL spun up on a web site is trivially easy nowadays. There's very little reason not to do it and a ton of reasons to do it... you and your friends notwithstanding.
 
jbregar said:
You don't use Google. That doesn't really change the fact that the OVERWHELMING majority of people on the Internet do use Google. A ton of them also use Google Chrome.
Click to expand...
As the saying goes: Just because a million flies eat ****.....

jbregar said:
The fact is, SSL doesn't hurt anything and it does have tangible, real-world benefits.
There's very little reason not to do it and a ton of reasons to do it..
Click to expand...

True. However it is not going to provide the security people think it does.
 
jagraphics said:
As the saying goes: Just because a million flies eat ****.....
Click to expand...

You just go ahead and tell a web client that you're not optimizing for Google because you don't use it and "just because a million flies eat ****...."

No, really. I'll wait.

Whether you like Google or not is irrelevant. Google is how a vast majority of the world finds information on the web. Doing things that hurt your rankings in Google means the information on your site isn't as accessible to the vast majority of the world. Sites like this are funded by advertising. Advertising needs eyeballs. Cutting out 70-90% of your potential eyeballs is really stupid. Not to mention that a UGC site like this actually only exists because people found it, found it interesting, and then decided to contribute. If they never find it in the first place, it never gets off the ground.

Hence why we spent most of the late 90s through 2000s doing contortions to support Internet Explorer of various versions... and Netscape Navigator before that.

True. However it is not going to provide the security people think it does.
Click to expand...

It provides more security than not using SSL, provides benefits other than that, and costs nearly nothing to actually do.

You're literally arguing for not putting on your seatbelt because in an accident you might die anyway. That's silly and terrible advice.
 
combatentropy said:
No, they are encrypted with JavaScript. It's a weaker formula than the latest HTTPS, but it is better than clear. Still I agree it would be nice to have this site be HTTPS.
Click to expand...

Not sure where you got this info... but I just logged into the site with JavaScript turned off... so it's not always true (if it is at all).

Not to mention that JavaScript-based encryption is by it's nature insecure. Let's say it is encrypted using JavaScript on the client side. That means that you're taking the user's input into the password field and hashing it, then sending it to the server for authentication. That means the server is no longer expecting the password, it's expecting the hashed token... which is being sent over the wire as unencrypted plain text. That solves the problem of shared passwords, but the site itself is still trivially easy to get into by just sending the hash.

An attacker can also take a look at the script files and look at the logic in use.

Or you could just put SSL in place.
 
jbregar said:
You just go ahead and tell a web client that you're not optimizing for Google because you don't use it and "just because a million flies eat s*%t...."

No, really. I'll wait.

Whether you like Google or not is irrelevant. Google is how a vast majority of the world finds information on the web. Doing things that hurt your rankings in Google means the information on your site isn't as accessible to the vast majority of the world. Sites like this are funded by advertising. Advertising needs eyeballs. Cutting out 70-90% of your potential eyeballs is really stupid. Not to mention that a UGC site like this actually only exists because people found it, found it interesting, and then decided to contribute. If they never find it in the first place, it never gets off the ground.

Hence why we spent most of the late 90s through 2000s doing contortions to support Internet Explorer of various versions... and Netscape Navigator before that.



It provides more security than not using SSL, provides benefits other than that, and costs nearly nothing to actually do.

You're literally arguing for not putting on your seatbelt because in an accident you might die anyway. That's silly and terrible advice.
Click to expand...

Nice mic drop. Point, set, and match to jbregar.
 
You must log in or register to reply here.
Back
Top