Adding SSL to a large site is a pain in the ass, speaking from personal experience. So many things you need to fix manually, not just installing the cert and editing htaccess.
Glad to see you upgrading the website!
To be honest I just cant wait until 2FA, that's when I'll be happy.
I find it quite funny how something which is meant to "protect us" has actually ended up doing the opposite. Luckily, Omniscient didn't implement it.
(Oct 17, 2014 11:19 PM)๖ۣۜÑåzgйŀ Wrote: No need of SSL
if a HF member ever goes on vacation he should use a VPN which supports encryption
then all information transferred in a unsafe environment (example:sketchy hotel room) will be safe
Not a smart idea actually. You can be merged/banned/closed if multiple HF members are using that same VPN. Hence, why it's not a good idea. Vacation ban is there for a reason.
I've been keeping up with this as some of my clients use SSL. SSL for a forum is totally unnecessary. It causes so many issues, for example third party services. It's needed for PayPal and banks, sure, but not for a forum. There is no sensitive information except login, and SSL can already be used on that page.
(Oct 17, 2014 08:00 PM)Omniscient Wrote: I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.
Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.
Don't have a laptop atm, so I usually have multiple JuiceSSH windows open haha. Few open atm. Mobile ssh client.
Good luck with 2FA. We are waiting eagerly for it.
Just finished disabling SSLv3 on all of my websites using SSL. Only TLSv1 now. I think that's the end of the SSLv3 life line now.
Simple fix:
ssl_ciphers SSLv3 TLSv1;
To
ssl_ciphers TLSv1;
Should be OK with all modern computers too
(Oct 18, 2014 09:21 PM)Cyrus Wrote: Two factor authentication should help around here alot - especially stopping accounts getting "hacked" which leads to stopping scams.
Half of the scams regarding hacked accounts here is the member pretending he was hacked and scamming.
Just because there is 2FA does not mean users will use them.
If I am not mistaken you plan on enabling 2FA for Ub3rs only right?
(Oct 19, 2014 12:46 AM)Understalker Wrote: Just because there is 2FA does not mean users will use them.
If I am not mistaken you plan on enabling 2FA for Ub3rs only right? If this were the case and ub3rs would be the only ones taking advantage of this, I believe nothing would really be done, besides of course the obvious, which is account safety for ub3rs. As a whole, it would be beneficial to the entire site if everyone were enabled 2FA.
(Oct 19, 2014 03:14 AM)Crypto™ Wrote: While I understand your points, having HTTPS is better than nothing at all. The exploit relies on a failover to SSL v3.0, which is coming up on 20 years old. The easy fix is to disable failover to SSL v3.0, not to disable SSL entirely. As for the second crack, I assume you're referring to Heartbleed, which only affected OpenSSL, a popular, but by far not the only, SSL library. Honestly, I think the SSL hacks are no excuse for not implementing some sort of SSL. It is of course dangerous to assume safety due to a single technology, but still, it's something to prevent basic MitM attacks.
Nothing's ever perfect, but I think we all need to give Omni a round of applause for all the work he does.
OpenSSL is very popular - a large percentage of websites use it, including Yahoo, CloudFlare etc. Heartbleed was important, whilst it was semi-hard to actually get some good data that was useful in my opinion, it was indeed important. SSL is something, sure, but when using a lot of external libraries or something you're going to have to update quite a lot to support SSL entirely. For example, I use SSL on my gaming forum and I can't embed from media sites that don't support SSL, namely Gamespot and IGN.
|
