support of https?

[Nsof]

prevents anyone* from eves dropping on what we post and message each other.
obviously this doesn't prevent anyone from scraping the site for content but the private messages are secure (and scraping is not easy).
* excluding major super powers' intelligence agencies.

can be self signed certificate to cut cost to zero, however there are some caveats. the biggest is that the first time one tries to enter the site using https one gets an ugly browser warning.

we should keep the regular http access.

login page should definitely be protected somehow otherwise someone at the coffee shop is going to sniff our pw

thoughts?

[Jedo the Jedi]

Are you keeping top-secret stuff on here that you think a random person will want? I personally can't see why anybody would want to hack my account on the GL other than to show they can.
_________________
Paragon Tally: 19 mafia, 3 SKs (1 twice), 1 cultist, numerous chat scum...and counting.

[Nsof]

I dont keep any super secret stuff here and I tend to agree that no one will want to hack our GL account. However,

In many cases people use the same pw over and over. If somebody fishes your GL pw while you were signing in to the GL then they might know something about your other pw.
PW should never be sent in cleartext.

all security agencies have systems that monitor internet traffic (hosted at your ISP). They sieve out traffic that looks interesting. https makes it much harder to do that.

why not do it?
_________________
Will sell this place for beer

[Neo]

Yeah. So, how do I do that?
_________________
_{Ad Astra}

[The Ragin' South Asian]

This is a real problem for the GL since 87% of users' passwords are "RSAissogreat"

[Zag]

In general, I would highly recommend that you don't use the same password for free sites that you use for, say, your bank account. In fact, I have only 2 passwords that I use a lot, with exactly that distinction. So, if you manage to hack my GL account, you'll also be able to get into my Facebook account and probably a dozen others, but nothing that would be worth your time.

[Jedo the Jedi]

[groza528]

[Jack_Ian]

I keep password regions, each with their own password and each with a different security level.
My PayPal, Banking etc passwords are long and complex.
My password here is very simple and the same as my mail account for this site.
My personal email has a higher level of security, though not as high as my PayPal A/C.

IMO supporting https for a public forum is like putting a time-lock on your kid's tricycle.
A lot of added complexity with the potential for the introduction of problems while adding very little real benefit securing something which should not be worth stealing in the first place.

[Nsof]

[The Potter]

The GL is maintained by countless hours voluntarily by our members. If you are able and willing to make the switch with minimal impact to the members it is possible to give you the necessary permissions. Providing the people currently with the keys feel that it is right.

I personally recommend using an easy password and don't associate your email. People don't use the email link much these days because of the messaging system. The ramifications of having your account hacked should be very minimal.

The old board used to have passwords that were visible to site administrators. Now that was low security!

[Jack_Ian]

To make things worse, it's not just the effort required to add in support for https, it's the effort to support it and re-add it back in for every new release of phpBB.

The solution is not to make the GL secure, but to place your valuable objects in a secure place. If you are in the habit of using the same password everywhere then how do you deal with online shopping that forces you to register? Will you trust those too just because they support https?