Passwords transmitted as plain text (community.nodebb.org)

tparnell

Hey guys,

I see that this forum's login page is using http, so passwords are going over the wire plain text....

Can you host this on https (and use a security cert) and do 301 redirects for http so passwords are transmitted in a secure fashion?

I'd hazard to guess that more than a few people who use this forum re-use passwords......

leo

Don't forget to enable HTTP Strict Transport Security (HSTS) if SSL is enabled for this site!

leo

Personally, I used SSO with Twitter to avoid sending my password in clear-text. Might be a good way to avoid sending passwords over the Internet in general.

tparnell

I dont disagree..I use SSO as well, but not everyone does....

julian

Sure -- we'll get around to implementing HTTPs at some point. It's already compatible (especially since you don't have to actually do anything if nginx handles the SSL handshaking/negotiation)

Just need to buy the certificate, really

psychobunny

Haha @julian promises not to eat lunch until wednesday, and we'll get that cert.

Scuzz

@psychobunny Cant you just self sign one until you can buy one?

finid

@Scuzz

Bad idea. Users will just be getting security warning about an untrusted or invalid site certificate that will scare them away.

finid

Comodo has a free, 90-day trial of their SSL cert. See promo here.

julian

Ah, I may as well just buy one. Honestly there's no excuse anymore, SSLs.com has 'em for $5...

frissdiegurke

So you just have to pass a spoon of caviar next lunch

leo

Or you could use StartSSL only for community.nodebb.org, but not sure if that would fall under their "no-commercial" policy.

julian

@leo @tparnell This community is now running over HTTPS.

finid

@julian

Nice. Did you buy from SSLs.com?

julian

Yeah, SSLs.com, which used to be cheapSSLs.com. In my opinion, you do get the same cert for a much lower price, so I didn't see any reason not to go with 'em.

We're looking to introduce SSL support as an add-on for our premium hosting packages (bundled with village & city, extra for hamlets)