Title: Insecure login Post by: mclarekin on March 29, 2017, 09:35:07 AM Lately when I go to log in I get a message that says the site is insecure?
Have others noticed this and what does it mean?? Title: Re: Insecure login Post by: Sockratease on March 29, 2017, 09:57:36 AM Lately when I go to log in I get a message that says the site is insecure? Have others noticed this and what does it mean?? So the site has some emotional problems to work through. Insecurity is a natural part of adolescence and it's impolite to tease about it. ... Sorry, that was just my Sarcalepsy acting up again. To answer the question, no - I have neither encountered that message before, nor have any idea what it could mean. Maybe it worries that the log in page might use http protocol instead of https? I really don't know. This is just another reason we need to upgrade to a newer version of forum software! The topic of upgrade has been cropping up a lot lately. Hopefully progress can be made soon! Meanwhile, we can take solace in the fact that no sensitive information is stored here except possibly a password. Hopefully nobody uses the same pass here as anywhere truly important or sensitive. No money changes hands here, so the most anyone could ever get from hacking us is a bunch of useless passwords. Thanks for letting us know and I'll see if I can get Christian to look into this. Title: Re: Insecure login Post by: mclarekin on March 29, 2017, 10:12:14 AM Thanks
BTW I think it happened 2-3 weeks ago. I am using firefox, and the only downside is that I have to type in my complete email address rather than it appearing once I had typed in "m". :) Title: Re: Insecure login Post by: zebastian on March 29, 2017, 12:09:38 PM Yes, its the login over http. http connections can be intercepted by a man in the middle and the login credentials could be compromised. Since 2 weeks or so firefox puts these warnings in the login fields. These will be visible for http / https with timedout certificate / https with invalid (self signed) certificates and i think for https certificates with TLS versions that are marked as vulnerable, too. |