[Ahri]

I fear these MITM because I tend to use public Wifi 40% of the time aka my college wifi. I'll have to just hope nothing happens.

[Levi]

I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.

Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.

It's definitely improved since last year, disruption is minimal in comparison.

[Ivy Mike]

I find it quite funny how something which is meant to "protect us" has actually ended up doing the opposite. Luckily, Omniscient didn't implement it.

[๖ۣۜÑåzgйŀ]

there is really no need of SSL
if a HF member ever goes on vacation or somewhere with public wifi he/she should use his own VPN client that connects back to HIS house which supports encryption
then all information that is transferred in that unsafe environment will stay safe from any man in the middle exploits

[Ivy Mike]

No need of SSL
if a HF member ever goes on vacation he should use a VPN which supports encryption
then all information transferred in a unsafe environment (example:sketchy hotel room) will be safe

Not a smart idea actually. You can be merged/banned/closed if multiple HF members are using that same VPN. Hence, why it's not a good idea. Vacation ban is there for a reason.

[๖ۣۜÑåzgйŀ]

Not a smart idea actually. You can be merged/banned/closed if multiple HF members are using that same VPN. Hence, why it's not a good idea. Vacation ban is there for a reason.

I corrected that I meant a VPN that connects to your house.
Your OWN VPN
not public, same IP.

[Abdilo]

I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.

Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.

See if i can guess what the ssh sessions are doing
One being:
tail -f access.log|grep '
The other:
root@hostname~:

also did you move domain registrars to one that cant get social engineered yet?, dont want egypt getting all 1337l33ts0c1l3n1n3ring again, atleast hf's main page wasnt turned into an iframe to an ek.

People using vpns could work just buy a vps and setup openvpn on it/ssh tunnel and with a vps only you have that ip, since you are paying for it, but when you stop paying for it.... well i highly doubt someone is going to sit there and buy vpses all day trying to get the ip you used to connect to hf from to scam.

I would say use tor but tor cant protect your data on clearnet without relying on ssl, thats why some sites have a .onion address even though the site is accessable via clearnet the onion address will be there just so users can use tor and be more secure then if you used ssl.

So omni could ad a .onion accessible domain, it stops mitm attacks over tor as well. but then you have a shitload of anonymous accounts and unless you create some way that proves that they are actually human(besides captcha) and that they do use that account(GAUTH + TOR?) its sorta hard to see if accounts have been comprimised.

also block account creation via tor as well, you can get a public list of exitnodes from torproject

[eXero]

Thanks for everything you do Omni. You're ahead of the game.

[420 Blaze It]

Interesting, but wouldn't it cause problems once you disable SSL?

[๖ۣۜÑåzgйŀ]

People using vpns could work just buy a vps and setup openvpn on it/ssh tunnel and with a vps only you have that ip, since you are paying for it, but when you stop paying for it....

I was thinking instead of a VPS a VPN connecting back to your home would be better, then there is no multiple Ip conflict. I mean its pretty easy to set one up anyways and no paying is required

[Abdilo]

I was thinking instead of a VPS a VPN connecting back to your home would be better, then there is no multiple Ip conflict. I mean its pretty easy to set one up anyways and no paying is required

EDIT: fuck me i didnt read what you said properly
i thought you meant while you at home, you vpn to your own ip, but that would be retarded if someone is already sniffing on your home network lawl

[Skorp]

Read about this couple days ago, thanks for the share again.

We may one day add SSL/TLS to the site.

I really hope you do not, saves alot of time and unnecessary drama. Time is golden as your todo list is never-ending. :)

[Robust]

I've been keeping up with this as some of my clients use SSL. SSL for a forum is totally unnecessary. It causes so many issues, for example third party services. It's needed for PayPal and banks, sure, but not for a forum. There is no sensitive information except login, and SSL can already be used on that page.

---

I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.

Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.

Don't have a laptop atm, so I usually have multiple JuiceSSH windows open haha. Few open atm. Mobile ssh client.

[Meester]

Good luck with 2FA. We are waiting eagerly for it.

[Robust]

Just finished disabling SSLv3 on all of my websites using SSL. Only TLSv1 now. I think that's the end of the SSLv3 life line now.

Simple fix:
ssl_ciphers SSLv3 TLSv1;
To
ssl_ciphers TLSv1;

Should be OK with all modern computers too