The Forums Are Now Closed!

The content will remain as a historical reference, thank you.

No SSL on forums

By on May 16, 2015 5:06:37 PM from Stardock Forums Stardock Forums

BFeely

Join Date 02/2003
0

This forum has no SSL/TLS security, even though it takes usernames and passwords.  Should be fixed ASAP.  Also, the main Stardock site only supports TLS 1.0, and not TLS 1.2.

Locked Post 15 Replies
Search this post
Subscription Options


Reason for Karma (Optional)
Successfully updated karma reason!
May 16, 2015 8:19:16 PM from JoeUser Forums JoeUser Forums

Not so sure that's crucial here.

Reason for Karma (Optional)
Successfully updated karma reason!
May 16, 2015 8:23:48 PM from Stardock Forums Stardock Forums

Any site that has logins and passwords should always have SSL/TLS.  It protects sensitive login information from being sniffed out by hackers and other cybercriminals.

I didn't enable the forums on my own personal website until I made sure SSL/TLS was fully in place and working.  In the end, it turned out to be easier to just make the whole site support TLS 1.2.

Reason for Karma (Optional)
Successfully updated karma reason!
May 16, 2015 8:37:08 PM from WinCustomize Forums WinCustomize Forums

Quoting BFeely,

It protects sensitive login information from being sniffed out by hackers and other cybercriminals.
I had my identity stolen once....... the guy brought it back and demanded an apology.  

 

 

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 1:40:20 AM from JoeUser Forums JoeUser Forums

Banks, sure.  Forum discussing PC gaming and software, not so "sensitive".  IMHO.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 10:39:47 AM from WinCustomize Forums WinCustomize Forums

Quoting Wizard1956,


Quoting BFeely,

It protects sensitive login information from being sniffed out by hackers and other cybercriminals.

I had my identity stolen once....... the guy brought it back and demanded an apology.  

 

 

Hehe, he probably went down town and got his face slapped by all those women you sought a bit of hanky pany from.  I mean, saying "I brought my own Viagra" just doesn't cut it anymore.  At least ya could've wined and dined 'em first... with the emphasis on the 'wined', cos admit it, mate, a woman 'd have to be a bit tipsy before hanky turned into panky with you.  Yes, I know, some gals find the rugged look appealing... handsome, even, but you're not likely to find too many cave women in your neck of the woods.

Hehe, again!  I had my identity stolen once.... bloke returned it 20 minutes later and I accepted the 50 bucks he paid me to take it back.

Seriously, identity theft is a serious issue and people can't be too careful in this day and age, what with all the scammers and skimmers being devised all the time to rob people of not only their money but also their dignity, of the trust and respect others once had for them

However, I don't know that we have too much to worry about here at WC.... so long as nobody signs in as me and starts calling Jafo all the so and so's under the sun.

All our bank/CC details are held at Stardock, which has been secured, so I'm not too worried my WC profile, etc.  Should anything untoward happen with my WC account, heaven forbid it does, I'm confident that Stardock and the relevant people will sort it out and notify me.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 12:58:39 PM from Stardock Forums Stardock Forums

They wouldn't be able to tell if someone at your ISP was sniffing passwords on unsecured connections.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 2:15:40 PM from JoeUser Forums JoeUser Forums

If sufficiently concerned, a VPN service is always an option.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 2:22:15 PM from Stardock Forums Stardock Forums

You mean those websites for hiding your activity when downloading pirated movies?  Just gives another node to get sniffed upon.

Maybe a moderator should respond.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 2:28:41 PM from WinCustomize Forums WinCustomize Forums

Quoting BFeely,

They wouldn't be able to tell if someone at your ISP was sniffing passwords on unsecured connections.

Okay, we'll start a petition to see if to see if members distrust their ISPs  If so, we'll petition them to see if they wanna petition the Admins at WC to see if they wanna petition Stardock to do a survey to see if we want SSL, ABS and SLi

Seriously, if it concerns you that much, there are ways to speak with people who may be able to assist: eg; Island Dog and Jafo, the site admins, or perhaps to Stardock directly, where all the site coding is done.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 2:44:55 PM from JoeUser Forums JoeUser Forums

Plenty of reasons to use a VPN service for legitimate internet activities.  Believe it or not, some people just want privacy, not a vehicle for petty crime.

Reason for Karma (Optional)
Successfully updated karma reason!
May 17, 2015 4:37:05 PM from WinCustomize Forums WinCustomize Forums

Quoting Daiwa,

Plenty of reasons to use a VPN service for legitimate internet activities.  Believe it or not, some people just want privacy, not a vehicle for petty crime.

Hehe, I want a vehicle for some petty fun... like sending anonymous emails to various public figures [won't call 'em politicians here] to call them all the ******s under the sun and other insulting names.

Seriously, though, many businesses are using VPNs to protect their interests, and more and more individuals are doing the same with so many scammers seeking to rip off peoples cash and identities, etc.  In fact, it's something I should look into, being I'm doing more online transactions these days due to ongoing mobility/getting out issues,

Reason for Karma (Optional)
Successfully updated karma reason!
June 5, 2015 11:17:20 PM from Stardock Forums Stardock Forums

Unless the VPN is directly to Stardock's network it's not going to really protect you from being sniffed while attempting to access Stardock's forum. The VPN only protects you from your client to the VPN server. Beyond that, it's all unencrypted again. The only real solution is for Stardock to deploy TLS to protect the site. 

As for whether it's a worthwhile investment, consider that many people use the same password for their main E-mail, forum logins, and bank accounts. Sniffing one then gives access to the others. Personally, I now use randomly generated passwords for all new logins I create and I use a different password for every site now. However, most people just recycle their logins so they don't forget them. 

Requesting TLS protection is perfectly legitimate, sensible, and reasonable. I deployed it tonight on a completely new Apache install in 30 minutes with an A+ rating from a third party SSL / TLS test service. 

http://i.imgur.com/M6pmGvX.png

It can even be done free of charge using startssl.com. On a side note, Stardock's SSL implementation for their main site gets poor ratings:

http://i.imgur.com/2D5nSm3.png

It only takes 30 minutes to do right. There is no good excuse. Even if it took a day, there still wouldn't be a good excuse.

 

Reason for Karma (Optional)
Successfully updated karma reason!
June 6, 2015 9:28:45 AM from Stardock Forums Stardock Forums


This forum has no SSL/TLS security, even though it takes usernames and passwords. Should be fixed ASAP.

The login occurs over HTTPS. You can confirm that yourself by checking the javascript or using an intercept proxy.

Reason for Karma (Optional)
Successfully updated karma reason!
June 6, 2015 9:50:31 AM from JoeUser Forums JoeUser Forums

Quoting egable1,

Personally, I now use randomly generated passwords for all new logins I create and I use a different password for every site now.

Yeah, yeah.  Next, you're going to tell me to stop using my user name as a password. Or my social security number as my SSID. 

Reason for Karma (Optional)
Successfully updated karma reason!
June 6, 2015 10:22:29 AM from Stardock Forums Stardock Forums

Quoting starkers,

Seriously, though, many businesses are using VPNs to protect their interests, and more and more individuals are doing the same with so many scammers seeking to rip off peoples cash and identities, etc.  In fact, it's something I should look into, being I'm doing more online transactions these days due to ongoing mobility/getting out issues,

Those VPNs are completely different from VPN services.  A business VPN is an extension of their private network, allowing employees on the road to access their network.  Such a VPN is an encrypted tunnel between the employee's computer and a server placed on the edge of the business network, giving the employee a fully private link between their computer and the business network.

"VPN" services simply use the same technology to allow a user to make an encrypted connection to the provider's servers which in turn act as a "gateway" to the Internet.  The only privacy afforded is between the customer's computer and the "VPN" provider, and once at the provider can be intercepted at any point from there to the web server the customer thinks is getting private access to.

Reason for Karma (Optional)
Successfully updated karma reason!
Stardock Forums v1.0.0.0    #101114  walnut1   Server Load Time: 00:00:00.0000359   Page Render Time: