Hello LQ staff!

I realized that www.linuxquestions.org was not configured to impose HTTPS. Why? I am using a firefox plugin "https everywhere", so thanks to EFF, my credentials are protected (well not from you, but at least from malicious listeners). But what about other people?

Living in 2017, and most basic processors embedding basic encryption instructions, why don't you setup HTTPS as default protocol? Or even better, why don't you simply forbid plain HTTP? Nobody would lag because of this.

I see your certificate is signed by GeoTrust, so why don't you use it?

(By the way, it expires in 2 months)

Regards.

You might find this thread interesting: https://www.linuxquestions.org/quest...ps-4175605642/

In a recent similar thread which I regret that I cannot find right now, Jeremy pointed out that login, contribution, and other information that should be confidential is encrypted.

My personal opinion is that encrypting stuff that doesn't need to be encrypted, such as the boating photos on my boating website, is not security; it's security theatre.

1 members found this post helpful.

It would be simple for jeremy to set linuxquestions as a https only site.

Ask him would be the reply.


My take on it that all sites should be https but I know that it isn't fool proof.

Thanks for the link. I join the "all link as https by default" team. However, to bypass some old protocol conflict (as stated in the thread), letting some pages be accessible in plain http (mainly for downloads) could be a good thing, and it changes my mind about "required https everywhere".

In general, anyone would want to be sure that they are talking to the person they are actually trying to contact, and not anyone else. A plain http download is pretty dangerous as if you don't check the file's fingerprint sum, you could potentially download any sh*t instead of your legit file. So, for this purpose (download over http), I still think it should be hosted on a separate site, to avoid fake DNS attack and malicious redirections. The separate site should have an enormous banner with written "AT YOUR OWN RISK". However, this is really not mandatory as you can download whatever you want from an other host supporting https and transfer it your own way to an old non-compatible toaster.

So, in my opinion, any internet page showing a logon formular should never be plain http anymore, not in 2017, and as much as possible, all websites should redirect http requests to https. While some websites are fighting against xss and cookie stealing (and https does not protect against that), some others let logon pages in plain text. I feel like this is disrespectful to the internet .

Thanks for the feedback. As I've noted a couple times, https is fully supported at LQ (and has been for a very long time), the login page is https-only, and the site will be moving to https by default after the pending code update.

--jeremy

Hello jeremy. I checked by myself and indeed, the logon form is sent over TLS. But an http prefix always leads to confusion. Thanks to you for the feedback !

Using a login link on the right, when it redirects automatically it redirects to http page not https.
Could be a bug, or intended. Not sure. The http page gets filtered by proxy, and then I need to add "s" and refresh the page every time.

Not sure which link you are referring to, but the one in the main nav is https and the login page itself will reload as https if loaded as http.

--jeremy

I'll try my best to explain.

The link on the screenshot, on the right side menu, it leads to:

https://www.linuxquestions.org/questions/lqlogin.php

Then I enter the info and when I hit login button it automatically redirects to:

http://www.linuxquestions.org/questions/index.php

Which just shows ERR_ACCESS_DENIED because the proxy blocks it.

Then I need to add https in front and refresh the page.

Attached Thumbnails

 

We'll be moving the entire site to https-only in the future. In there interim there are a couple browser addons to accomplish this.

--jeremy

1 members found this post helpful.

Thank you for reply, it seems to work fine with noscript.httpsForced

1 members found this post helpful.

As an update: https://www.linuxquestions.org/quest...te-4175612452/

--jeremy