+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Why isn't https://hackforums.net mandatory? (/showthread.php?tid=4380549)
Pages: Pages
1
2
Why isn't https://hackforums.net mandatory? - Abdilo - Aug 6, 2014
I'll break it down into a list:
1. https://hackforums.net is broken and shows white crap, therefore making it unusable and more or less forcing users to use http
2. if you use http that leaves you wide open for mitm attacks
3. This is WILL help stop the amount of accounts being hijacked
4. You could phish and dns poising a network and they would have no way of confirming if hf is actually hf(if you do not have https).
So hf.... Why?
btw chrome even says: click to run Unsafe Script.
Seriously?
Hell even after the nsa revelations proving that http trafic is getting sniffed by the nsa same with all traffic, it makes it allot easier form the NSA to blackmail(see xkeyscore), log, attack, redirect, and infect users of hf.
The classic responds i presume i will be getting:
If you are doing something bad then you deserve to be caught.
https://hackforums.net/showthread.php?tid=4354263&pid=41387978#pid41387978
I find this reply.. sorta dump... You ARE entering personal information when you doing deals over pms, You are leaving yourself open to packet manipulation.
Example:
my paypal address is: [email protected]
my paypal address is: [email protected]
My btc address is: 12391203921301920102
What really gets sent: 239299239193292911
Sniffing ohh look what i found:
Here are your login details to your vpn:
Ns4_H8x
randompassword
login=username&password=password
thanks for everything..now i can archive all of your pm's and leave without you realizing and if you say you where hacked the ip's match.
Anyone else think this way?
* - TheNakedEmperor - Aug 6, 2014
True, hf needs to work properly on https even though we don't use payment information it still affects our other personal information
ill wait for omni's respond.
* - Skorp - Aug 6, 2014
Do you have PROOF of accounts being hijacked through MITM attacks on HF? 🤦♂
* - Abdilo - Aug 6, 2014
(Aug 6, 2014 03:01 AM)Skorp Wrote: Do you have PROOF of accounts being hijacked through MITM attacks on HF? 🤦♂...i have hijacked my own account so many god damn times when i have been testing different session stealing programs(droidsheep)
* - My Dixie Normous - Aug 6, 2014
You don't need https on this site lol you are not entering any sensitive information.
Quote:This is WILL help stop the amount of accounts being hijacked
Also i don't think there has ever been an account stolen because of http.
* - Darkwin - Aug 6, 2014
Its been suggested before, This was Omniscient's response https://hackforums.net/showthread.php?tid=4241867&pid=40229808#pid40229808
* - Abdilo - Aug 6, 2014
(Aug 6, 2014 03:03 AM)Mii T. CentOS Wrote: You don't need https on this site lol you are not entering any sensitive information.
Also i don't think there has ever been an account stolen because of http.
go down to macdonalds or w/e there is free wifi.
site there for a day sniffing.
see how many hf accounts you get.
works better in bigger citys
* - D3V1lx_x - Aug 6, 2014
Yeah OP is right it needs to work properly on https since some membrs recklessly post their infos.
* - Skorp - Aug 6, 2014
Grey Hat Mafia's Bitch Wrote:...i have hijacked my own account so many god damn times when i have been testing different session stealing programs(droidsheep)
Anyone can do it on themselves lol. 🤦♂ I'm asking if you have PROOF that others accounts have been hijacked through MITM methods (program being insignificant)?
* - Abdilo - Aug 6, 2014
(Aug 6, 2014 03:09 AM)Skorp Wrote: Anyone can do it on themselves lol. 🤦♂ I'm asking if you have PROOF that others accounts have been hijacked through MITM methods (program being insignificant)?As i said if you want to go and see for yourself, go to a big enough city mitm at macdonalds or hell even use a wifi pineapple for passer byers.
I shouldn't need to go hijack a bunch of hf accounts to prove my point.
* - xploD - Aug 6, 2014
Omni's response does make sense. Probably why whenever i've tried https theres been issues.
* - The LAD Bible - Aug 6, 2014
Shouldn't been too hard to fix that.
Shouldn't be mandatory but should be functioning and advertised.
Edit:
Fix these errors, fix the theme:
![[Image: UgRcHUf.png]](https://i.imgur.com/UgRcHUf.png)
Only problem then is people who just use http:// in img links, sometimes browsers don't like this.
* - Dragosthethird - Aug 6, 2014
If you want the theme and images fixed use a userscript. Search the forums I am sure theres one. If you check my post there is a workable one somewhere. A forum isn't designed for HTTPS as we can't control user content and for the amount of user content the server space if we were to store it would be outrageous.
* - Dmitriy - Aug 6, 2014
I was wondering the same thing. I thought it has a SSL certificate as a lot of times you could have www. instead of https:// which is still encrypted. But this isn't I tried wire shark many times and sniffed my account credentials
(Aug 6, 2014 07:22 PM)Dragosthethird Wrote: If you want the theme and images fixed use a userscript. Search the forums I am sure theres one. If you check my post there is a workable one somewhere. A forum isn't designed for HTTPS as we can't control user content and for the amount of user content the server space if we were to store it would be outrageous.
it does not have to be encrypted completely. Just the login page and sign up page which is enough just like payment sites do. You could choose just specific link which would be more than enough
* - Hollywood Undead - Aug 6, 2014
(Aug 6, 2014 03:04 AM)Grey Hat Mafias Bitch Wrote: go down to macdonalds or w/e there is free wifi.
site there for a day sniffing.
see how many hf accounts you get.
works better in bigger citys
I'm usually busy sniffing all the Big Mac's being shoved down my throat. 🤝