[Omniscient]

https://www.openssl.org/~bodo/ssl-poodle.pdf

Some of you might be paying attention to these rather publicized exploits but some may not. In either case the latest exploit bug in SSL was released about a week ago and labeled "Poodle" which stands for "Padding Oracle On Downgraded Legacy Encryption".

It's basically a MITM exploit. Not really easy to take advantage of but considering this is now the 2nd time a huge SSL exploit was published I just wonder why members still send me requests for us to add SSL.

It's imho very dangerous to falsely assume your safe because your browser has a little lock icon. You should be relying on your own knowledge and your own connection for your own security.

We may one day add SSL/TLS to the site. Not sure when if ever but it might come. I just don't see why members are pushing for it at a time when SSL has been cracked twice. And I've not once had an account stolen via MITM.

We're more in need of other security options for accounts beyond an SSL connection like 2FA. Which I am currently working on.

Thanks everyone and enjoy.

[Dr.Cooper]

Thanks for the awesome info. Reading it right now Omni! :) Cheers!

[Cyba]

Adding SSL to a large site is a pain in the ass, speaking from personal experience. So many things you need to fix manually, not just installing the cert and editing htaccess.

[Aura]

Saw this yesterday. Google and Mozilla are supposed to adjust their browsers to make them more secure to use and prevent that exploit from hitting them but for now all of them (browsers) are vulnerable.

[Fox™]

This is sad, and adding SSL to large sites, as stated above is a pain. I'm excited for 2FA though. c:

[Wafflemonger]

Yeah, I remember reading this last week and thinking the exact same thing, "Won't really be an issue for most networks out there unless there's a disgruntled employee or no one notices someone sitting there with a laptop for hours on end."

[Inkling]

Poodle's a rather old exploit, isn't it?
I remember reading about this exploit like a year ago.

[Tuna]

Glad to see you upgrading the website!

[Tony Stark]

Hopefully this provides answers to those pushy people.

Been waiting patiently for 2FA. Hopefully members will be at peace knowing their accounts will be more secure and their security is more in their control once it's implemented.

[Omniscient]

I like how the easy fix is as simple as "disable ssl". :)

[Autopost]

To be honest I just cant wait until 2FA, that's when I'll be happy.

[ZuGgY]

Oh damn, first Heartbleed and now this? o_O

[Blazin]

Wow more SSL shit being exposed wonderful.

[Rote]

Really glad that we got someone like you mate,
keeping yourself updated so we stay safe. :)

[Omniscient]

I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.

Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.