• Visitors can check out the Forum FAQ by clicking this link. You have to register before you can post: click the REGISTER link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. View our Forum Privacy Policy.
  • Want to receive the latest contracting news and advice straight to your inbox? Sign up to the ContractorUK newsletter here. Every sign up will also be entered into a draw to WIN £100 Amazon vouchers!

SSL Certificate

Collapse
X
  •  
  • Filter
  • Time
  • Show
Clear All
new posts

    SSL Certificate

    Could CUK get one please?

    #2
    Originally posted by Scratch It View Post
    Could CUK get one please?
    Costs £10

    Not in Brexit Britain, we need it for soup kitchens.

    Comment


      #3
      It's free with automated renewals at https://letsencrypt.org

      However adding ssl would be pointless due to all the unencrypted photos already linked to on this site so it's a can't see the point from me
      Last edited by eek; 28 June 2017, 08:42.
      merely at clientco for the entertainment

      Comment


        #4
        Originally posted by eek View Post
        It's free with automated renewals at https://letsencrypt.org

        However adding ssl would be broken due to all the unencrypted photos already linked to on this site so it's a can't see the point from me
        Been using letsencrypt on http://camnomis.com/ for a while, seems to be god enough for most basic sites (ie nothing eComm) and most people expect to see a padlock etc. these days
        Originally posted by Stevie Wonder Boy
        I can't see any way to do it can you please advise?

        I want my account deleted and all of my information removed, I want to invoke my right to be forgotten.

        Comment


          #5
          Im curious as to what benefit an SSL cert would bring to CUK?

          Yeah, ok the traffic to the site would be encrypted, but its a public forum, any traffic (except your password when you log in) will most likely end up on a public forum anyway...

          Comment


            #6
            Originally posted by Snarf View Post
            Im curious as to what benefit an SSL cert would bring to CUK?

            Yeah, ok the traffic to the site would be encrypted, but its a public forum, any traffic (except your password when you log in) will most likely end up on a public forum anyway...
            I guess the password is big un, would be fairly easy to monitor network traffic and get login details. Then anyone could login and post random crap, it's clear from General this happens frequently.

            Comment


              #7
              Originally posted by woohoo View Post
              I guess the password is big un, would be fairly easy to monitor network traffic and get login details. Then anyone could login and post random crap, it's clear from General this happens frequently.
              At least they are sending a hash of the password over the Internet between your browser and CUK.
              Not that it helps much against someone adequately motivated as it's a simple hash of the password, so someone could simply use that to perform a fake login (but at least they won't know your real password - e.g. if you use it on other sites).

              If CUK were to maybe add digest authentication, then at least the hash would be different for each login attempt.
              (still doesn't completely prevent a dedicated MITM to fool you into revealing your real password but would make it harder and more sophisticated)

              It might just be easier to add SSL though.

              Comment


                #8
                Originally posted by yetanotherbob View Post
                At least they are sending a hash of the password over the Internet between your browser and CUK.
                Not that it helps much against someone adequately motivated as it's a simple hash of the password, so someone could simply use that to perform a fake login (but at least they won't know your real password - e.g. if you use it on other sites).

                If CUK were to maybe add digest authentication, then at least the hash would be different for each login attempt.
                (still doesn't completely prevent a dedicated MITM to fool you into revealing your real password but would make it harder and more sophisticated)

                It might just be easier to add SSL though.
                It's incredibly easy to break the hash that CUK uses to find out the actual password. So if you do use it on other sites then don't.

                FYI just google break hash, one of the top ten will allow you to enter the hash and it will be converted to plain text. So you don't even need to be dedicated, just half interested.

                TBH it's not that big a deal for me, CUK doesn't hold my cc details. Though it does hold my email and I suppose you could use that along with the password on a number of popular websites. I'm lucky I don't think that combination would work on anything, only because it's using an old email address.
                Last edited by woohoo; 9 July 2017, 17:47.

                Comment


                  #9
                  Originally posted by woohoo View Post
                  It's incredibly easy to break the hash that CUK uses to find out the actual password. So if you do use it on other sites then don't.
                  Good point: https://en.wikipedia.org/wiki/MD5#Security

                  Comment


                    #10
                    You shouldn't be using the same password on sites you value as on CUK anyway.
                    "I can put any old tat in my sig, put quotes around it and attribute to someone of whom I've heard, to make it sound true."
                    - Voltaire/Benjamin Franklin/Anne Frank...

                    Comment

                    Working...
                    X