Page 1 of 2 12 LastLast
Results 1 to 40 of 49

Thread: [RESOLVED] Still no SSL?

  1. #1

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Resolved [RESOLVED] Still no SSL?

    Come on guys, its 2020, SSLs are literally FREE. Why is there still no ssl being used?
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  2. #2
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    Are you doing any monetary transactions behind the scene here that you want to confess too?

  3. #3
    ex-Administrator brad jones's Avatar
    Join Date
    Nov 2002
    Location
    Indianapolis
    Posts
    6,608

    Re: Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    Are you doing any monetary transactions behind the scene here that you want to confess too?
    Doesn't SSL help protect login information as well - something that has been compromised by forums before...... ?

  4. #4

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Yes indeed Brad, you should most def try and push for a SSL, its free, there's no strings attached!

    I believe its "Let's Encrypt" is the service. They even offer a way to automatically renew it, so you never lift a finger.

    10-15 years ago, SSLs were a "bank" or rare thing, now its a standard. We are suppose to be "somewhat" professionals? Why in the name of common sense are we not following common practices?

    Hopefully this is on the to do list.
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  5. #5

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    Are you doing any monetary transactions behind the scene here that you want to confess too?
    No? I only browse once in a while I am in a Discord server pretty much a full time contributor there.
    SSLs are NOT just for banks and transactions. They are to to encrypt the traffic between the server and client. Login credentials can be "grabbed" during transmission, thats why the last time there was a bunch of our passwords dumped onto a pastebin that it happened. Traffic isn't encrypted. In fact many browsers by default show a "site not secure" warning.


    Its kind of easy to figure out why SSLs are important. Google is your friend for research and many articles on the importance.

    EDIT: FYI I still am getting the duplicated post error :P
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  6. #6
    PowerPoster kfcSmitty's Avatar
    Join Date
    May 2005
    Posts
    2,248

    Re: Still no SSL?

    Don't think the powers that be would care about the actual security, however I do know Google has started lowering the priority and giving warnings when accessing a site that has no TLS.

    You would think the forum keeping its high ranking on Google would be a priority.

  7. #7

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Forums are a dying breed because of the inability to update security rules, while there is still quite of bit of traffic, whos to say in a few years google blocks this site period in search results? Then what happens to the next generation of coders? I guess there is discord communities
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  8. #8

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Seems like the company that owns this forum their basic static site, is using SSL....
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  9. #9
    Super Moderator Shaggy Hiker's Avatar
    Join Date
    Aug 2002
    Location
    Idaho
    Posts
    38,943

    Re: Still no SSL?

    It does seem like an obvious step. Non-SSL is clearly going away. We use SSL on everything, need it or not.
    My usual boring signature: Nothing

  10. #10
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    Quote Originally Posted by brad jones View Post
    Doesn't SSL help protect login information as well - something that has been compromised by forums before...... ?
    Yes it does. And luckily NO ONE in their right mind uses the same info on multi sites... So if we saw Bard Jones posting here daily we'd know his account has been compromised

  11. #11
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    The powers-that-be wrote back and said that the conversion to SSL is being worked on as we speak.

    There are some "mixed content errors" that are being fixed on the one guinea pig site. Once they resolve the errors they can do the SSL configuration for the other eight sites.

    <<<STAY TUNED>>>

  12. #12
    PowerPoster jdc2000's Avatar
    Join Date
    Oct 2001
    Location
    Idaho Falls, Idaho USA
    Posts
    2,391

    Re: Still no SSL?

    Note that certificates will now expire every year:

    https://www.zdnet.com/article/apple-...ate-lifespans/

  13. #13
    PowerPoster
    Join Date
    Feb 2006
    Posts
    24,482

    Re: Still no SSL?

    I find it highly unlikely that the passwords were acquired by somebody who was tapping logons between users and the site. I begin to doubt that the loud voices above even have a clue how anything works.

  14. #14

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    I don’t? Ok
    Read this one for ya. Explains everything that “I don’t know”
    https://security.stackexchange.com/q...ssl-connection
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  15. #15

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    The Grand-Dad of the Internet even says use HTTPS from 4 years ago.
    https://blog.mozilla.org/tanvi/2016/...r-http-please/
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  16. #16
    PowerPoster kfcSmitty's Avatar
    Join Date
    May 2005
    Posts
    2,248

    Re: Still no SSL?

    Dil means that someone compromised the site and got access to the database. From that they got our (I assume hashed) passwords.

    People weren't sniffing the login page to get the data.

  17. #17

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Quote Originally Posted by kfcSmitty View Post
    Dil means that someone compromised the site and got access to the database. From that they got our (I assume hashed) passwords.

    People weren't sniffing the login page to get the data.
    Yea, but that doesn't defeat the reasons they should be using SSL. Sites with prior attacks usually get targeted again. No SSL just makes it that much easier to complete.

    The funniest part is people hack and paste passwords in like a pastebin, they do it for fun, sometimes they dont even do it for malicious purposes. But, again, the idea is prevention.

    Also the fact the forum is using a very outdated version of vbulletin prob wont help either.
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  18. #18
    Smooth Moperator techgnome's Avatar
    Join Date
    May 2002
    Posts
    34,522

    Re: Still no SSL?

    Well, pretty soon, I may not be able to access the site - at least from work. They're taking cyber security more seriously, and with us doing gov't work, rightfully so... pretty soon a new policy will be pushed out restricting access to http sites.

    -tg
    * I don't respond to private (PM) requests for help. It's not conducive to the general learning of others.*
    * I also don't respond to friend requests. Save a few bits and don't bother. I'll just end up rejecting anyways.*
    * How to get EFFECTIVE help: The Hitchhiker's Guide to Getting Help at VBF - Removing eels from your hovercraft *
    * How to Use Parameters * Create Disconnected ADO Recordset Clones * Set your VB6 ActiveX Compatibility * Get rid of those pesky VB Line Numbers * I swear I saved my data, where'd it run off to??? *

  19. #19
    PowerPoster kfcSmitty's Avatar
    Join Date
    May 2005
    Posts
    2,248

    Re: Still no SSL?

    Quote Originally Posted by jdc20181 View Post
    Also the fact the forum is using a very outdated version of vbulletin prob wont help either.
    Especially since, if we are using 4.2.5 like Steve said here, it has been EOL since end of 2017.

  20. #20

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    And if its the cost they have a problem with, they aren't really making money off this site? other than from ads, so they could easily just go to an open source alternative, like Discourse, its modern, clean and very well maintained.
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  21. #21
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    The powers-that-be wrote back and said that the conversion to SSL is being worked on as we speak.

    There are some "mixed content errors" that are being fixed on the one guinea pig site. Once they resolve the errors they can do the SSL configuration for the other eight sites.

    <<<STAY TUNED>>>
    I think some of you missed this post.

    The highlight-> "The conversion to SSL is being worked on as we speak."

    And for an update - one sister site down - 8 more to go.



    So RELAX

  22. #22
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    O-M-G Say it ain't so

  23. #23
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    BUT - maybe one of you experts can explain:

    The Main Forum page here is SECURE.
    Drilling down into a section of the site like Feedback is SECURE.
    Drilling down into a thread shows the Not Secure.....even though the url shows HTTPS.

  24. #24
    PowerPoster kfcSmitty's Avatar
    Join Date
    May 2005
    Posts
    2,248

    Re: Still no SSL?

    It isn't secure because there is mixed content on the page.. some of the stuff is being loaded up with http instead of https.

    Looks like it is this:

    http://www.vbforums.com/images/edito....gif?t=B8DJ5M3

    and on the same note: wooooo!

  25. #25
    Smooth Moperator techgnome's Avatar
    Join Date
    May 2002
    Posts
    34,522

    Re: Still no SSL?

    Still... it's a step forward...

    Or is it a jump to the left?


    -tg
    * I don't respond to private (PM) requests for help. It's not conducive to the general learning of others.*
    * I also don't respond to friend requests. Save a few bits and don't bother. I'll just end up rejecting anyways.*
    * How to get EFFECTIVE help: The Hitchhiker's Guide to Getting Help at VBF - Removing eels from your hovercraft *
    * How to Use Parameters * Create Disconnected ADO Recordset Clones * Set your VB6 ActiveX Compatibility * Get rid of those pesky VB Line Numbers * I swear I saved my data, where'd it run off to??? *

  26. #26
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: Still no SSL?

    The developers wrote back.... They aren't finished. My Bad.

  27. #27
    ex-Administrator brad jones's Avatar
    Join Date
    Nov 2002
    Location
    Indianapolis
    Posts
    6,608

    Re: Still no SSL?

    Quote Originally Posted by techgnome View Post
    Pretty soon a new policy will be pushed out restricting access to http sites.
    This is the biggest reason companies need to go Https. Browsers and companies are flagging sites. At some point they will start blocking.

    Cool to hear that it is (finally) being added. (And yeah, posts two days in a row. Was my account hacked.... )

  28. #28
    Super Moderator Shaggy Hiker's Avatar
    Join Date
    Aug 2002
    Location
    Idaho
    Posts
    38,943

    Re: Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    Yes it does. And luckily NO ONE in their right mind uses the same info on multi sites... So if we saw Bard Jones posting here daily we'd know his account has been compromised
    Or he's in his minstrel cycle.
    My usual boring signature: Nothing

  29. #29
    Smooth Moperator techgnome's Avatar
    Join Date
    May 2002
    Posts
    34,522

    Re: Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    The developers wrote back.... They aren't finished. My Bad.
    You mean they didn't reply back with "Works fine on my machine." ?? Amateurs...

    -tg
    * I don't respond to private (PM) requests for help. It's not conducive to the general learning of others.*
    * I also don't respond to friend requests. Save a few bits and don't bother. I'll just end up rejecting anyways.*
    * How to get EFFECTIVE help: The Hitchhiker's Guide to Getting Help at VBF - Removing eels from your hovercraft *
    * How to Use Parameters * Create Disconnected ADO Recordset Clones * Set your VB6 ActiveX Compatibility * Get rid of those pesky VB Line Numbers * I swear I saved my data, where'd it run off to??? *

  30. #30

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Not to be a smart ass... But @Steve, Web Development is just like .NET Development, there is a thing called Debugging. As KFC Pointed out its because of mixed content, if you are using Chrome, or the new Edge (That is using Chromium) and open up console, there is a tab called "Security" - Here is what I found - only one seems to be causing the issue.
    looks like its the Favicon giving the issues - http://www.vbforums.com/favicon.ico
    Attachment 177899
    Last edited by jdc20181; Jul 11th, 2020 at 11:30 AM.
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  31. #31
    ex-Administrator brad jones's Avatar
    Join Date
    Nov 2002
    Location
    Indianapolis
    Posts
    6,608

    Re: Still no SSL?

    Works fine on my machine.

  32. #32

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: Still no SSL?

    Quote Originally Posted by brad jones View Post
    Works fine on my machine.
    seems to still be happening for me, but I can prob try a data dump and see what happens
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  33. #33

    Thread Starter
    Frenzied Member jdc20181's Avatar
    Join Date
    Oct 2015
    Location
    Indiana
    Posts
    1,168

    Re: [RESOLVED] Still no SSL?

    Name:  6c68c30503f4aa0e3bf6db5d8c0bde67.png
Views: 506
Size:  26.1 KB
    Disclaimer: When code is given for example - it is merely a example.




    Unless said otherwise indicated - All Code snippets advice or otherwise that I post on this site, are expressly licensed under Creative Commons Attribution 4.0 International Please respect my copyrights.

  34. #34
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: [RESOLVED] Still no SSL?

    jdc20181 - is there any chance you can take a CHILL PILL

    Please wait till you see "ME" type out the words - COME AND GET IT!!!!!

    That will tell you and others that the developers are done with the conversion AND that they'd like any feedback we have.

  35. #35
    PowerPoster
    Join Date
    Feb 2006
    Posts
    24,482

    Re: [RESOLVED] Still no SSL?

    This is a silly thing to spend time on. Nobody is spying on your logon in order to get your password. When they want passwords they just trick the server into delivering the entire list.

    Spend more time fixing broken stuff like attachments instead.

  36. #36
    ex-Administrator brad jones's Avatar
    Join Date
    Nov 2002
    Location
    Indianapolis
    Posts
    6,608

    Re: Still no SSL?

    Quote Originally Posted by brad jones View Post
    Works fine on my machine.
    Um.... this was kind of meant as a joke based on the previous posts..... Sorry someone took me seriously. I'll refrain from joking (in this thread) going forward....

  37. #37
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: [RESOLVED] Still no SSL?

    UPDATE - this thread that everyone is reading right now shows to be NOT SECURE.

    There are two members that have posted in this thread that have HTTP links within their signature. Those links are the cause.

    Also if someone linked to an image on a site that is HTTP, that too would cause the issue.

    These types of issues can't be/won't be corrected.

  38. #38
    PowerPoster kfcSmitty's Avatar
    Join Date
    May 2005
    Posts
    2,248

    Re: [RESOLVED] Still no SSL?

    Quote Originally Posted by Steve R Jones View Post
    There are two members that have posted in this thread that have HTTP links within their signature. Those links are the cause.

    Also if someone linked to an image on a site that is HTTP, that too would cause the issue.
    Linking an image is correct, but your first point is not. Having an anchor on the page that is HTTP will not result in a not-secure error.

  39. #39
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2012
    Location
    Largo, FL.
    Posts
    1,820

    Re: [RESOLVED] Still no SSL?

    Quote Originally Posted by kfcSmitty View Post
    Linking an image is correct, but your first point is not. Having an anchor on the page that is HTTP will not result in a not-secure error.
    Great. Can you explain why this thread is Not Secure?

  40. #40
    Smooth Moperator techgnome's Avatar
    Join Date
    May 2002
    Posts
    34,522

    Re: [RESOLVED] Still no SSL?

    Must have been fixed... I'm showing that this thread is now secured...

    -tg
    * I don't respond to private (PM) requests for help. It's not conducive to the general learning of others.*
    * I also don't respond to friend requests. Save a few bits and don't bother. I'll just end up rejecting anyways.*
    * How to get EFFECTIVE help: The Hitchhiker's Guide to Getting Help at VBF - Removing eels from your hovercraft *
    * How to Use Parameters * Create Disconnected ADO Recordset Clones * Set your VB6 ActiveX Compatibility * Get rid of those pesky VB Line Numbers * I swear I saved my data, where'd it run off to??? *

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width