chrome to start naming and shaming

[psyolent]

fyi dudes

http://www.itnews.com.au/news/chrome-to ... tes-436765

in essence all non https sites will be flagged as being, well, not secured.

don't 'password' share your password with other sites, as, if the site is HTTP only, then, passwords are sent in plain text.

admins, any thoughts to a SSL cert for our fine site? happy to donate to make it possible. just say when.

[antus]

We have had one for some time. Ive just been reluctant to force https as it could break someone somewhere. Untill i flick the forum switch some images etc remain http so right now you might see a mixed content warning. Trivial to lock it in properly though. Feel free to use it Maybe this is just the reason to start forcing it.

https://pcmhacking.net/forums/

It should score highly here too:
https://www.ssllabs.com/ssltest/analyze ... net&latest

Click the hosts once its run to see the details.

[Dylan]

New bookmark saved.

[psyolent]

good stuff antus.
it will sook over the non HTTPS stuff until you get that action solved mate, and all that HSTS shit.
as i mentioned b4 alot of people share their welcome1 passwords across sites and ; given the pwnedlists which are coming out these days every user almost needs to have a full blown password manager .....

[antus]

Well, what do you know. Its was only the ipv6 logo at the bottom that was hard coded http (and didnt have a secure https server backing it). I moved the image over locally and that has resolved the mixed content warning. I dont think HSTS is a problem, and the apache build is too old to support it. Its fine for now and the next few years.

I wonder if I should force https though? Cant be a bad thing right? If anyone still wants to use the forum on android 2.x or internet explorer 6, or internet explorer 8 on windows XP speak now.... you're the folks who will have problems.

[j_ds_au]

Only the login need/should be SSL/TLS.

As for Chrome, couldn't care less ...

Joe.

[antus]

Well ive forced the whole site https (I dont have the time or care to find and add hooks for the various bits of login). Lets see what happens. Now the mixed content thing is solved it should work pretty well.

[Tazzi]

Well ive forced the whole site https (I dont have the time or care to find and add hooks for the various bits of login). Lets see what happens. Now the mixed content thing is solved it should work pretty well.

Was the first thing I noticed.. bright green https up in the top corner!. Seems to be working hunky dorey

[immortality]

Working here for me.

[psyolent]

Only the login need/should be SSL/TLS.

no, not really buddy, the whole shebang does, as, traffic can be intercepted (read hijacked) with mixed content ....
working all AOK here antus - good work. note the MITM web gateway has injected its cert in place of yours so it can inspect ; and ; it still works. no ssl bypass for me