"Not secure" in Forum url

Former_MSE_Andrea · 1 February 2017 at 1:24PM

Hi everyone

You may have seen the words “not secure” in your url when visiting the forum in the last few days. This is a change Google has recently put into place for sites that don’t run on HTTPS.

Our technical team is working on this now and you should see it disappear once the work's been rolled out.

Thanks for your patience.

MSE Forum Team

kwikbreaks · 3 March 2017 at 11:50PM

It's worth noting that the change simply highlights the fact that the MSE login isn't HTTPS and has always been insecure not that any change made by Google has somehow made the login insecure.

alanq · 23 March 2017 at 5:31PM

This issue also affects Firefox 52.0.1.

https://blog.mozilla.org/security/2017/01/20/communicating-the-dangers-of-non-secure-http/

Jabba_flabba · 29 April 2017 at 11:30AM

...it's about the absence of transport layer security for sending/receiving data (and, most importantly, sending passwords).

I'd love to know what the technical team are so busy with that justifies continuing to run this site without SSL. Sending passwords in the clear is just plain bad and inexcusable in 2017. Wireshark screenshot:

My advice to users of this site is to make sure your MSE password isn't the same or even close to the same as the passwords you use for more sensitive sites such as your email (password reuse is generally bad anyway - but particularly worth emphasising here).

The reason for my advice should be plain enough; if your MSE password gets stolen, say, because you've used it while being connected to e.g. open access WiFi, then it's possible the thief could then access your email.

DragonQ · 26 May 2017 at 11:50PM

Still no HTTPS 4 months later. Even my home website with nothing useful on it has HTTPS, it really isn't difficult to set up!

Former_MSE_Andrea · 8 June 2017 at 4:37PM

Hi, this is in the pipeline, we'll let you know when we have an update.

Andrea

MothballsWallet · 30 June 2017 at 9:47PM

At least one more person (myself included) are getting the same thing, as per this thread.

RobJDean185 · 27 September 2017 at 6:14PM

The continued lack of HTTPS is a surprising security flaw for a web site that has so many users and so much traffic. Also, failure to add HTTPS, which is specific but not technically unusual, nearly a year after the users started requesting it, implies that not enough effort is invested in security of the site (e.g. when was the last time a penetration test was run on here, is the patching up to date, do the admin staff have remote access through HTTP, etc).

Every forum member, especially anyone logging in from public WiFi networks, is exposed to theft of their user ID and passwords as highlighted. This opens a range of risks for the individual, such as, how many people, although they shouldn't, will reuse their user name and password from here on other sites?

I appreciate the forums might be run on a shoestring budget and this is a prioritisation not a work harder problem, but this ought to be getting attended to.

moneyistooshorttomention · 28 September 2017 at 8:07AM

over 3 months ago that it was "in the pipeline".

Which certainly shows it is deemed extremely low priority - if indeed on the list/still on the list in the first place.

djc58 · 10 December 2017 at 5:43PM

The MSE site still not secured connection on FireFox so trying to added " HTTPS " but not recognise. How solve that? Do the site have secured connection especially when log in?
Thanks

Jabba_flabba · 10 December 2017 at 6:52PM

djc58 wrote: »

The MSE site still not secured connection on FireFox so trying to added " HTTPS " but not recognise. How solve that?

The only solution is for the site forum technical admins to configure the forum to use TLS. There's nothing you can do, unfortunately.

djc58 wrote: »

Do the site have secured connection especially when log in?

No. There's some client side hashing going on so the password isn't sent over the wire in plain text. However, I'm assuming this means the hash becomes the password; if anyone were to eavesdrop your connection, they would just use the hash. There is also another login form which pertains to the old version of the forums. The old version is a user preference changeable in User Control Panel. The login form pertaining to the old version of the forums does send the password in plain text. But without TLS, both are as bad as each other.

If anyone has a Twitter account perhaps they'd like to nudge Martin :money: about this. It's been an issue for a long time and I really don't get a sense from the admins here that they understand its importance. The sheer length of time this has been an issue speaks volumes.

"Not secure" in Forum url

Comments

Categories

Get our FREE Weekly email full of deals & guides - and it’s spam-free