SSL/secure login?

Rick N · September 3rd, 2008, 07:17 PM

I'd really love it if defensivecarry.com would implement https, so I could log in and view the forum over an encrypted, secure connection. Currently, authentication is occurring over an unsecured connection, so:

someone using an unsecured, public Wifi connection (e.g. at a coffee shop) could have their password snatched right out of the air
someone using an anonymity network such as Tor could be vulnerable to exit node eavesdropping
pretty much any connection could be vulnerable to a man-in-the-middle attack

Just a suggestion!

JonInNY · September 3rd, 2008, 09:11 PM

Just my opinion back, but it might be overkill to security enable DC.com. This is not a "high-security" site. There are no financial transactions, or any other high risk transmissions, other than occasional rants and political posts.

I would recommend that you just use a simple, "throw away" password, that you are not using for any other site login anywhere else.

Also, security certificates cost money, and since this is a free site (except for the great volunteer site supporters), it might be a burdensome expense to the administrator.

Anyway, that's my 2¢.

retsupt99 · September 4th, 2008, 01:47 AM

Quote:

Originally Posted by JonInNY

Just my opinion back, but it might be overkill to security enable DC.com. This is not a "high-security" site. There are no financial transactions, or any other high risk transmissions, other than occasional rants and political posts.

I would recommend that you just use a simple, "throw away" password, that you are not using for any other site login anywhere else.

Also, security certificates cost money, and since this is a free site (except for the great volunteer site supporters), it might be a burdensome expense to the administrator.

Anyway, that's my 2¢.

I would say that this DC forum IS a financially risky site...every time I see another nice gun, I think about how I might buy it!

Bumper · September 4th, 2008, 04:41 AM

While I agree that many sites need to be secured, I don't believe we currently have that need. We have never had any reported incidents of accounts being compromised and not sure what someone would do if they did have a password to an account since we don't handle sensitive personal information. Those that donate to the forum do so through PayPal, which is over a secure, encrypted connection. The forum never has access to either your PayPal account or credit card information. All that is returned to us after the transaction is complete is a transaction number, member name, date/time and the amount donated. And that information is available only to me, as the site administrator.

It is a good idea, however, to safeguard your account by periodically changing your password. Those that may access the site through a public computer should also make certain that they log off completely before leaving the computer. Should you ever suspect that your account has been compromised, please let me know immediately. The vBulletin software does keep track of all IP addresses associated with, or used to access, member accounts. IPs originating through a proxy are summarily rejected.

JonInNY · September 4th, 2008, 08:35 AM

Quote:

Originally Posted by retsupt99

I would say that this DC forum IS a financially risky site...every time I see another nice gun, I think about how I might buy it!

I never though about it that way. And gee, I'm picking up a new gun myself today. I guess you're right!

ctr · September 5th, 2008, 01:14 PM

The content of our wonderful site is not Secret or even Top Secret. If you are worried about man-in-the middle attacts, you should see what the staff at some NOCs do!

FN1910 · September 5th, 2008, 08:08 PM

Watch out for the black helicopters circling your house right now. You have already been discovered.

September 3rd, 2008, 07:17 PM	#1
Rick N New Member Join Date: Aug 2008 Location: Salt Lake City, UT Posts: 11	SSL/secure login? I'd really love it if defensivecarry.com would implement https, so I could log in and view the forum over an encrypted, secure connection. Currently, authentication is occurring over an unsecured connection, so: someone using an unsecured, public Wifi connection (e.g. at a coffee shop) could have their password snatched right out of the air someone using an anonymity network such as Tor could be vulnerable to exit node eavesdropping pretty much any connection could be vulnerable to a man-in-the-middle attack Just a suggestion! __________________ "We have it in our power to begin the world over again." - Thomas Paine My public PGP key

September 3rd, 2008, 09:11 PM	#2
JonInNY VIP Member Join Date: Jan 2008 Location: Mid-Hudson Valley New York State Posts: 2,525	Just my opinion back, but it might be overkill to security enable DC.com. This is not a "high-security" site. There are no financial transactions, or any other high risk transmissions, other than occasional rants and political posts. I would recommend that you just use a simple, "throw away" password, that you are not using for any other site login anywhere else. Also, security certificates cost money, and since this is a free site (except for the great volunteer site supporters), it might be a burdensome expense to the administrator. Anyway, that's my 2¢. __________________ "The right of voting for representatives is the primary right by which all other rights are protected." -- Thomas Paine ____________________________ Quis custodiet ipsos custodes? (Who will guard the guards?) -- Juvenal

September 4th, 2008, 04:41 AM	#4
Bumper Administrator Join Date: Jun 2004 Location: Arizona Posts: 14,054	While I agree that many sites need to be secured, I don't believe we currently have that need. We have never had any reported incidents of accounts being compromised and not sure what someone would do if they did have a password to an account since we don't handle sensitive personal information. Those that donate to the forum do so through PayPal, which is over a secure, encrypted connection. The forum never has access to either your PayPal account or credit card information. All that is returned to us after the transaction is complete is a transaction number, member name, date/time and the amount donated. And that information is available only to me, as the site administrator. It is a good idea, however, to safeguard your account by periodically changing your password. Those that may access the site through a public computer should also make certain that they log off completely before leaving the computer. Should you ever suspect that your account has been compromised, please let me know immediately. The vBulletin software does keep track of all IP addresses associated with, or used to access, member accounts. IPs originating through a proxy are summarily rejected. __________________ Bumper Administrator DefensiveCarry.com Forum Coimhéad fearg fhear na foighde; Beware the anger of a patient man.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

September 5th, 2008, 01:14 PM	#6
ctr Member Join Date: Aug 2007 Location: Virginia Posts: 245	The content of our wonderful site is not Secret or even Top Secret. If you are worried about man-in-the middle attacts, you should see what the staff at some NOCs do!

September 5th, 2008, 08:08 PM	#7
FN1910 Ex Member Join Date: Aug 2007 Location: SC Posts: 1,236	Watch out for the black helicopters circling your house right now. You have already been discovered.