Redirect HTTPS to HTTP for this forum? - Page 2

elvey · 16 May 2017, 08:45 AM

From an end-user perspective the most important thing is to be sure the password you use for these forums is not used for any other accounts. The fact that it's likely that many folks don't follow that advice makes the forum a rather attractive target. I follow it, and have for many years.

evilquoll · 19 May 2017, 10:07 PM

Authentication != encryption. Another point raised in that discussion is that an SSL certificate only proves that you're on the site that the URL says you're on; a link could point you to www.еmаіІdіѕсuѕѕіоnѕ.соm and you wouldn't know (from the URL or the certificate) that it isn't this site (apart from the "w", "m", "d" and "." characters, all the characters in that link are Cyrillic; goodness knows where, if anywhere, that link leads).

popowich · 10 Jun 2017, 12:54 AM

Encrypt everything by default is the way the world is going. SSL/TLS certificates can be obtained for free now. Eventually popular web browsers are going to begin displaying a warning or "not secure" when a site is running on http which could confuse visitors. For a site as old as this with lots of links, when the change is made, some care should be made not to mess up the redirection and there could be some temporary SEO type issues. It's probably good to get done sooner or later. Since revenue generation isn't much of a concern here I'd think it's best to just get it done at a convenient time for E.

16 May 2017, 08:45 AM	#16
elvey The "e" in e-mail Join Date: Jan 2002 Location: San Francisco Posts: 2,458	From an end-user perspective the most important thing is to be sure the password you use for these forums is not used for any other accounts. The fact that it's likely that many folks don't follow that advice makes the forum a rather attractive target. I follow it, and have for many years.

19 May 2017, 10:07 PM	#17
evilquoll Member Join Date: May 2017 Location: Emergency temporary account of ROBERT.BAK Posts: 36	Authentication != encryption. Another point raised in that discussion is that an SSL certificate only proves that you're on the site that the URL says you're on; a link could point you to www.еmаіІdіѕсuѕѕіоnѕ.соm and you wouldn't know (from the URL or the certificate) that it isn't this site (apart from the "w", "m", "d" and "." characters, all the characters in that link are Cyrillic; goodness knows where, if anywhere, that link leads).

10 Jun 2017, 12:54 AM	#18
popowich Essential Contributor Join Date: May 2009 Posts: 263 Representative of: EmailQuestions.com	Encrypt everything by default is the way the world is going. SSL/TLS certificates can be obtained for free now. Eventually popular web browsers are going to begin displaying a warning or "not secure" when a site is running on http which could confuse visitors. For a site as old as this with lots of links, when the change is made, some care should be made not to mess up the redirection and there could be some temporary SEO type issues. It's probably good to get done sooner or later. Since revenue generation isn't much of a concern here I'd think it's best to just get it done at a convenient time for E.