Should forum.defcon.org be SSL only?

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Dark Tangent
    The Dark Tangent
    • Sep 2001
    • 2732
    #1

    Should forum.defcon.org be SSL only?

    Hey everyone, I'd like everyone's input on switching forum.defcon.org over to ssl only. Brief background:

    The way we do redirection from http to https is a clever kludge Cot came up with, but it prevents us from using http compression, which would speed things up for everyone. Now that mobile devices have supported http compression for years we may as well take advantage of it, not to mention it would be like getting extra free capacity.

    With ssl only some of the xss and related attacks would be more difficult and MITM concerns would almost vanish.

    The downside is some people might not be able to log in through proxies (I can over tor, though), at free WiFi locations, etc.

    So here is a poll! Comment here and vote too!
    35
    Yes! Maximum security above all else! Compression good!
    91.43%
    32
    Maybe, I'll have to test and see if https only will work for me.
    5.71%
    2
    No! I have to use http, it's the only option I have.
    0%
    0
    No! Compression is for weaklings! Buy more badwidth and ignore XSS!
    0%
    0
    I don't care that some search engines won't index an ssl only site.
    34.29%
    12
    I do care that my forum posts won't be indexed by search engines.
    5.71%
    2
    I don't know, but want to vote.
    5.71%
    2
    None of the above fits, so I will comment below.
    2.86%
    1

    The poll is expired.

    PGP Key: https://defcon.org/html/links/dtangent.html
    Tags: None
    • streaker69
      • Mar 2008
      • 1141
      #2
      Re: Should forum.defcon.org be SSL only?

      Wave of /.edness comes over me.

      First Vote!
      A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

        Comment

        • TheCotMan
          *****Retired *****
          • May 2004
          • 8857
          #3
          Re: Should forum.defcon.org be SSL only?

          Originally posted by Dark Tangent
          The way we do redirection from http to https is a clever kludge Cot came up with...
          Actually, I think that the kludge I created ensures that links to any post or server with defcon.org remains https even if the poster posts it as http, when the web browser visiting the site is visiting with https.
          In a similar way, when a user is visiting with http, all defcon.org links to any defcon.org servers appear as http even if they were https.

          This helps to make sure people desiring https get https to defcon.org links, and people that can't do https, only get http links from the forums to defcon.org domains.

          This is the function that will be lost.

          Now pics.defcon.org is another story. Without this kludge, that software will only generate links to http: no matter how you log in. Eventually, any https session will become an http session without this kludge. If we change to only offer https, then the new default for it can become https: instead of http:

          HTH,
          -Cot

          Originally posted by streaker69
          Wave of /.edness comes over me.

          First Vote!
          Stop it! Don't let that spread here! My eyes! My eyes! My brain! Wait. My brain no longer hurts, and I have a strange desire to go out and buy lottery tickets, and watch lots of TV. Why did I want to go to the library anyway? ;-)

          See... this is what happens. First you add blog software, and the next thing you know, we turn into myspace. :-P~~

          No soup for you!
          Last edited by TheCotMan; November 18, 2008, 15:29.

            Comment

            • KinoEye
              Industrial Fascist
              • May 2004
              • 41
              #4
              Re: Should forum.defcon.org be SSL only?

              Originally posted by TheCotMan
              First you add blog software, and the next thing you know, we turn into myspace. :-P~~
              Actually I would prefer we turn into Utherverse as posting porn is against the Myspace TOS.

              That said I vote yes on HTTPS.
              When in danger or in doubt, run in circles scream and shout.

                Comment

                • Dark Tangent
                  The Dark Tangent
                  • Sep 2001
                  • 2732
                  #5
                  Re: Should forum.defcon.org be SSL only?

                  OK, looks like it is leaning SSL only...
                  PGP Key: https://defcon.org/html/links/dtangent.html

                    Comment

                    • Greyhatter
                      Banned
                      • May 2007
                      • 408
                      #6
                      Re: Should forum.defcon.org be SSL only?

                      Visiting our site is encrypted, login is encrypted, but after that some browsers show our site not fully encrypted after login, but then I'm not buying anything here. Mods want to know more ask me privately.

                        Comment

                        • Dark Tangent
                          The Dark Tangent
                          • Sep 2001
                          • 2732
                          #7
                          Re: Should forum.defcon.org be SSL only?

                          Get your vote in.. only a week remains!
                          PGP Key: https://defcon.org/html/links/dtangent.html

                            Comment

                            • Greyhatter
                              Banned
                              • May 2007
                              • 408
                              #8
                              Re: Should forum.defcon.org be SSL only?

                              HTTPS= Your right to your privacy and your freedom at this time only until squash. When that is broken your dongle will be blowin' in the breeze (plz. no PP&M references).

                                Comment

                                • Dark Tangent
                                  The Dark Tangent
                                  • Sep 2001
                                  • 2732
                                  #9
                                  Re: Should forum.defcon.org be SSL only?

                                  Looks like SSL wins.. now to get ready to make some changes. I think the cookies that are getting set by the forums are not setting the "secure" bit.
                                  PGP Key: https://defcon.org/html/links/dtangent.html

                                    Comment

                                    • TheCotMan
                                      *****Retired *****
                                      • May 2004
                                      • 8857
                                      #10
                                      Re: Should forum.defcon.org be SSL only?

                                      Originally posted by Dark Tangent
                                      Looks like SSL wins.. now to get ready to make some changes. I think the cookies that are getting set by the forums are not setting the "secure" bit.
                                      Ok. I will look to move over to exclusively support https for pics and forum. This will probably happen after 4:00pm pacific time today, or late on the 25th.

                                        Comment

                                        • astcell
                                          Human Rights Issuer
                                          • Oct 2001
                                          • 7512
                                          #11
                                          Re: Should forum.defcon.org be SSL only?

                                          Do overseas visitors have access to 128 bit encryption now? I recall at one time all they could get was 56 bit.

                                            Comment

                                            • YenTheFirst
                                              Member
                                              • Aug 2008
                                              • 282
                                              #12
                                              Re: Should forum.defcon.org be SSL only?

                                              extremely minor point - there's a typo on the http warning page:
                                              "(We will ask your browser to forward you to that same link in 30 seconds, but you can select that link now to skip the 30 secon wait.)"

                                              the 'd' got dropped from second. (I 'spose that's what I get for dropping the 's' from https)
                                              It's not stupid, it's advanced.

                                                Comment

                                                • TheCotMan
                                                  *****Retired *****
                                                  • May 2004
                                                  • 8857
                                                  #13
                                                  Re: Should forum.defcon.org be SSL only?

                                                  Originally posted by YenTheFirst
                                                  extremely minor point - there's a typo on the http warning page:
                                                  "(We will ask your browser to forward you to that same link in 30 seconds, but you can select that link now to skip the 30 secon wait.)"

                                                  the 'd' got dropped from second. (I 'spose that's what I get for dropping the 's' from https)
                                                  Thanks for the report!

                                                  Updated in forums and pics. It may take a while for cached data to stopped being cached with this content, but a forced refresh should fix that.

                                                    Comment

                                                    • Dark Tangent
                                                      The Dark Tangent
                                                      • Sep 2001
                                                      • 2732
                                                      #14
                                                      Re: Should forum.defcon.org be SSL only?

                                                      Originally posted by TheCotMan
                                                      Thanks for the report!

                                                      Updated in forums and pics. It may take a while for cached data to stopped being cached with this content, but a forced refresh should fix that.
                                                      Speaking of which I just fixed an http 'connection' header problem on pics and implemented some filtering on www. Please let us know if anything is acting wrong.
                                                      PGP Key: https://defcon.org/html/links/dtangent.html

                                                        Comment

                                                        Previous template Next
                                                        Working...