Hack Forums
[Feedback] With CloudFlare's new features... - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [Feedback] With CloudFlare's new features... (/showthread.php?tid=5422429)

Pages: Pages 1 2 3

With CloudFlare's new features... - Deatives - Oct 2, 2016

I know you guys haven't used HTTPS in the past because of the issues it would cause with your theme. I read the thread however since then CloudFlare has added a new feature.

As stated in their user control panel:

Quote:Automatic HTTPS Rewrites

Automatic HTTPS Rewrites helps fix mixed content by changing "http" to "https" for all resources or links on your web site that can be served with HTTPS.


This would mean you guys could setup HTTPS and force it through page views and it wouldn't cause theme issues allowing HackForums Users more security. I think this should go under serious consideration. Your thoughts?

* - Elitas - Oct 2, 2016

How do you do this in Cloudflare Settings?

* - Phil - Oct 2, 2016

(Oct 2, 2016 01:15 PM)xHackerPr0 Wrote:  How do you do this in Cloudflare Settings?

Cloudflare -> Your domain -> Crypto -> Last option is "Automatic HTTPS Rewrites" and turn it on 😕

* - Elitas - Oct 2, 2016

(Oct 2, 2016 01:22 PM)DehPhil Wrote:  Cloudflare -> Your domain -> Crypto -> Last option is "Automatic HTTPS Rewrites" and turn it on 😕

Thanks!

* - ZuGgY - Oct 2, 2016

I still don't think Omniscient would add this. Technically, IIRC, we did have HTTPS (at least on the login page), but with broken theme features. This has been requested and debated about for a long time. Wondering to see what happens now, I guess?

* - Deatives - Oct 2, 2016

(Oct 2, 2016 01:55 PM)ZUGGY Wrote:  I still don't think Omniscient would add this. Technically, IIRC, we did have HTTPS (at least on the login page), but with broken theme features. This has been requested and debated about for a long time. Wondering to see what happens now, I guess?

Yeah but enabling this new feature would remove the issues. Now it's up to Omni to decide whether he will enable the new feature and give us the https many of us always wanted :D

* - Omniscient - Oct 2, 2016

I'll look into how CF does it and how it would effect HF. My only concern with HTTPS protocol is that browsers may give visitors a broken page or even block the page because not all content will be HTTPS.

I'd rather serve unencrypted content than have pages blocked by browsers.

EDIT:

Mmmm....

Quote:What is Automatic HTTPS Rewrites?
Automatic HTTPS Rewrites is a feature that safely rewrites links to unencrypted resources from HTTP to HTTPS. Before the rewrite is applied and served in the HTML sent to your web visitors, a ruleset is checked to ensure the references are accessible via HTTPS.
Why Should I use Automatic HTTPS Rewrites?
If your site contains links or references to HTTP URLs that are also available securely via HTTPS, Automatic HTTPS Rewrites can help. If you connect to your site over HTTPS and the lock icon is not present, or has a yellow warning triangle on it, your site may contain references to HTTP assets (“mixed content”).
Mixed content is often due to factors not under the website owner’s control such as embedded third-party content or complex content management systems. By rewriting URLs from “http” to “https”, Automatic HTTPS Rewrites simplifies the task of making your entire website available over HTTPS, helping to eliminate mixed content errors and ensuring that all data loaded by your website is protected from eavesdropping and tampering.
Note: Only URLs that are known to support HTTPS will be rewritten. We use data from EFF’s HTTPS Everywhere and Chrome’s HSTS preload list, among others, to identify which domains support HTTPS.


That doesn't sound that great.

* - Deatives - Oct 3, 2016

(Oct 2, 2016 10:03 PM)Omniscient Wrote:  I'll look into how CF does it and how it would effect HF. My only concern with HTTPS protocol is that browsers may give visitors a broken page or even block the page because not all content will be HTTPS.

I'd rather serve unencrypted content than have pages blocked by browsers.

EDIT:

Mmmm....


That doesn't sound that great.

Any URL that CloudFlare can confirm in their database that supports HTTPS will be rewritten. You should definitely do further testing before putting the idea away :)

* - Neeeeeeeeeel.- - Oct 3, 2016

(Oct 3, 2016 03:59 AM)Deatives Wrote:  Any URL that CloudFlare can confirm in their database that supports HTTPS will be rewritten. You should definitely do further testing before putting the idea away :)
But most of the URLs over de Internet doesn't support HTTPS, so we will be at the same point... just less errors, but the solution it's not 100%. I don't think it will be implemented.

If Omni makes an in-site "wrapper" to deliver each third-party content from HF (replacing the URLs with regular expressions) could make the site 100% https BUT the site will get a lot more traffic because EVERYTHING will go thought HF servers. Plus attackers could use the wrapper to affect HF servers. Btw, this could be setup in a completly different server (or servers) with a different domain and will work, but it will cost a lot + attacker could still "take down" the third-party resources servers. So I'm sure it won't be done.

* - Deatives - Oct 3, 2016

(Oct 3, 2016 04:14 AM)Neeeeeeeeeel.- Wrote:  But most of the URLs over de Internet doesn't support HTTPS, so we will be at the same point... just less errors, but the solution it's not 100%. I don't think it will be implemented.

If Omni makes an in-site "wrapper" to deliver each third-party content from HF (replacing the URLs with regular expressions) could make the site 100% https BUT the site will get a lot more traffic because EVERYTHING will go thought HF servers. Plus attackers could use the wrapper to affect HF servers. Btw, this could be setup in a completly different server (or servers) with a different domain and will work, but it will cost a lot + attacker could still "take down" the third-party resources servers. So I'm sure it won't be done.

The wrapper wouldn't be abusable. It'd just make everything go over HTTPS. Also every resource I've seen on the page links to hackforums.net (CSS, Images, JS, and the sort). It wouldn't be anything that could cause errors. I'd like to see HackForums grow to use the same technologies that other forums are using :)

* - Neeeeeeeeeel.- - Oct 3, 2016

(Oct 3, 2016 04:25 AM)Deatives Wrote:  The wrapper wouldn't be abusable. It'd just make everything go over HTTPS. Also every resource I've seen on the page links to hackforums.net (CSS, Images, JS, and the sort). It wouldn't be anything that could cause errors. I'd like to see HackForums grow to use the same technologies that other forums are using :)

Thisone it's not linked to HF domain

[Image: mRlbuxF.jpg]

* - Deatives - Oct 3, 2016

But literally every resource linked on the home page is on the root domain even resources linked in the CSS.

* - Neeeeeeeeeel.- - Oct 3, 2016

(Oct 3, 2016 07:07 AM)Deatives Wrote:  But literally every resource linked on the home page is on the root domain even resources linked in the CSS.
We know that, it was already fixed. But Omni is also concerned about third-party resources like the one I posted above.

* - Deatives - Oct 3, 2016

(Oct 3, 2016 07:13 AM)Neeeeeeeeeel.- Wrote:  We know that, it was already fixed. But Omni is also concerned about third-party resources like the one I posted above.

Like if a user links to non HTTPS images? He has two options:
1) Image proxy thru Tor to hide backend IP
2) Let image display as is.

Just a note the image won't refuse to display in most browsers however it will show a warning (not read https but the gray one and show a 'connection is private but some resources could be modified in transit' message). Your thoughts?

* - Omniscient - Oct 3, 2016

Quote:But most of the URLs over de Internet doesn't support HTTPS


I'm not sure about the percentage but that does concern me. We have a lot of websites advertised by members that aren't SSL compatible. Even a signature by a high post count member with an image from a smaller domain without SSL may cause pages to not load for visitors with secure browser settings. I think that's unreasonably negative for the small benefit SSL will offer.

Quote:If Omni makes an in-site "wrapper" to deliver each third-party content from HF (replacing the URLs with regular expressions) could make the site 100% https BUT the site will get a lot more traffic because EVERYTHING will go thought HF servers.


Would also make us a lot more susceptible to DDOS attacks or possibly even other exploits.

Quote:I'd like to see HackForums grow to use the same technologies that other forums are using


HTTPS was not designed for forums. It was designed for encrypting traffic with banks or other sensitive data and websites. We don't need it. That's the real bottom line. I really don't care what other forums use.

Quote:But literally every resource linked on the home page is on the root domain even resources linked in the CSS.


Maybe you don't know how HTTPS works. All the links on the page would need to be HTTPS as well.

Quote:1) Image proxy thru Tor to hide backend IP


Tor is blocked.

Quote:2) Let image display as is.


Unfortunately we have too many members that are unsophisticated. Especially noobish members who come here to get some help. I don't need them encountering browser errors about the site be insecure. Would you go to HACKforums.net, get a browser warning, and then choose to ignore it? I think many would just opt to click away. That's my personal behavior whenever I go to a site and the browser gives me a security warning. I close the window without a second thought.