SSL Certificate

[Scratch It]

[woohoo]

You shouldn't be using the same password on sites you value as on CUK anyway.

True but people do and they also make mistakes, it's also true the security on CUK is tulipe.

[cojak]

You shouldn't be using the same password on sites you value as on CUK anyway.

[yetanotherbob]

It's incredibly easy to break the hash that CUK uses to find out the actual password. So if you do use it on other sites then don't.

Good point: https://en.wikipedia.org/wiki/MD5#Security

[woohoo]

At least they are sending a hash of the password over the Internet between your browser and CUK.
Not that it helps much against someone adequately motivated as it's a simple hash of the password, so someone could simply use that to perform a fake login (but at least they won't know your real password - e.g. if you use it on other sites).

If CUK were to maybe add digest authentication, then at least the hash would be different for each login attempt.
(still doesn't completely prevent a dedicated MITM to fool you into revealing your real password but would make it harder and more sophisticated)

It might just be easier to add SSL though.

It's incredibly easy to break the hash that CUK uses to find out the actual password. So if you do use it on other sites then don't.

FYI just google break hash, one of the top ten will allow you to enter the hash and it will be converted to plain text. So you don't even need to be dedicated, just half interested.

TBH it's not that big a deal for me, CUK doesn't hold my cc details. Though it does hold my email and I suppose you could use that along with the password on a number of popular websites. I'm lucky I don't think that combination would work on anything, only because it's using an old email address.

[yetanotherbob]

I guess the password is big un, would be fairly easy to monitor network traffic and get login details. Then anyone could login and post random crap, it's clear from General this happens frequently.

At least they are sending a hash of the password over the Internet between your browser and CUK.
Not that it helps much against someone adequately motivated as it's a simple hash of the password, so someone could simply use that to perform a fake login (but at least they won't know your real password - e.g. if you use it on other sites).

If CUK were to maybe add digest authentication, then at least the hash would be different for each login attempt.
(still doesn't completely prevent a dedicated MITM to fool you into revealing your real password but would make it harder and more sophisticated)

It might just be easier to add SSL though.

[woohoo]

Im curious as to what benefit an SSL cert would bring to CUK?

Yeah, ok the traffic to the site would be encrypted, but its a public forum, any traffic (except your password when you log in) will most likely end up on a public forum anyway...

I guess the password is big un, would be fairly easy to monitor network traffic and get login details. Then anyone could login and post random crap, it's clear from General this happens frequently.

[Snarf]

Im curious as to what benefit an SSL cert would bring to CUK?

Yeah, ok the traffic to the site would be encrypted, but its a public forum, any traffic (except your password when you log in) will most likely end up on a public forum anyway...

[SimonMac]

It's free with automated renewals at https://letsencrypt.org

However adding ssl would be broken due to all the unencrypted photos already linked to on this site so it's a can't see the point from me

Been using letsencrypt on http://camnomis.com/ for a while, seems to be god enough for most basic sites (ie nothing eComm) and most people expect to see a padlock etc. these days

[eek]

It's free with automated renewals at https://letsencrypt.org

However adding ssl would be pointless due to all the unencrypted photos already linked to on this site so it's a can't see the point from me

[DimPrawn]

Could CUK get one please?

Costs £10

Not in Brexit Britain, we need it for soup kitchens.

[Scratch It]

Could CUK get one please?