HTTPS on the ContractorUK

[cojak]

I believe that Admin is already looking at this aspect of the forum.

[SimonMac]

And even dumber if you don’t have a burner email account...

Ah so that's why we, some people have sockies.

[SimonMac]

that's the attitude. You don't want to make any effort to protect your members.

It's a risk vs reward situation, if you are protecting PCI data and at risk of millions of pounds in fines the reward for activating HTTPS is high, if the only think to protect are email addresses and password, it makes greater sense to educate the denizens in good practise when it comes to password management as HTTPS in itself is not 100% secure

[woohoo]

It's a risk vs reward situation, if you are protecting PCI data and at risk of millions of pounds in fines the reward for activating HTTPS is high, if the only think to protect are email addresses and password, it makes greater sense to educate the denizens in good practise when it comes to password management as HTTPS in itself is not 100% secure

I don't see much in the way of education going on.

Https is a lot more secure than Http. It just a basic thing you should do.

It's not just about login/passwords, it's also about the topics you are reading and posting on being visible.

[SueEllen]

I don't see much in the way of education going on.

Https is a lot more secure than Http. It just a basic thing you should do.

It's not just about login/passwords, it's also about the topics you are reading and posting on being visible.

They are via Google.

[woohoo]

They are via Google.

If you are at a clients site. You decide to read or post something negative about the client. The client could be monitoring the network and will see the post in clear text. Just an example but you get my meaning.

[Fred Bloggs]

It's a risk vs reward situation, if you are protecting PCI data and at risk of millions of pounds in fines the reward for activating HTTPS is high, if the only think to protect are email addresses and password, it makes greater sense to educate the denizens in good practise when it comes to password management as HTTPS in itself is not 100% secure

Could be wrong, but my own experience with BBS software, phpBB, is that the passwords are encrypted by default. So even those with top tier admin rights can't see the passwords. I'm guessing the same applies here too.

[woohoo]

Could be wrong, but my own experience with BBS software, phpBB, is that the passwords are encrypted by default. So even those with top tier admin rights can't see the passwords. I'm guessing the same applies here too.

CUK, encrypts the password using md5, which is then sent in clear text across the interweb. It's trivial to decrypt the password.

Posts, urls etc are all visible in plain text.

[TheFaQQer]

Posts, urls etc are all visible in plain text.

They are also in plain sight.

[woohoo]

They are also in plain sight.

If you mean someone can see your monitor whilst posting, yes. Plain sight.

However, if you mean it's just on google like Sue posted then the client example. If you are at a clients site, you post negative things or read dodgy stuff on CUK or any site without SSL, assume your client is looking over your shoulder.

I think I'm like a dog with a bone, it doesn't affect me, it's the people that don't understand this that it affects. So, I think Cojak said admin is looking at it and he will know more about his own site than I do.