|
View previous topic :: View next topic
|
| Author |
Message |
Nic Clouston
Global Moderator
Joined: 10 May 2007
Posts: 2455
Location: Hampshire, UK
|
|
|
|
| Norton blocked my signin today saying that this is a suspicious site. When are you going to provide Secure Sign in? Here and the beginners. |
|
| Back to top |
|
 |
steve-myers
Active Member
Joined: 30 Nov 2013
Posts: 917
Location: The Universe
|
|
|
|
Just a comment - not to throw stones at anyone - but this is an issue that's been brewing for a long time.
Now I don't follow phBB forum software, but has phBB addressed this issue? If it has, has our forum installed whatever phBB software addresses this issue?
For you lurkers out there, phBB software is used for this message board, as well as many other forums with a similar goal. It is quite popular and runs some very popular - and heavily trafficked - forums. |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
|
|
| This is not about phpBB. The issue is because of the missing https protocol. We will be migrating soon. |
|
| Back to top |
|
|
steve-myers
Active Member
Joined: 30 Nov 2013
Posts: 917
Location: The Universe
|
|
|
|
| Yes, but does phpBB support https protocol? Or is that strictly a web server issue? |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
|
|
| Yes, PhbBB supports https. |
|
| Back to top |
|
|
Nic Clouston
Global Moderator
Joined: 10 May 2007
Posts: 2455
Location: Hampshire, UK
|
|
|
|
| The problem with Norton appears to be fixed as it did not intercede today. Looking forward to the https: sign-in coming. |
|
| Back to top |
|
|
Nic Clouston
Global Moderator
Joined: 10 May 2007
Posts: 2455
Location: Hampshire, UK
|
|
|
|
| Norton warned me again this evening. |
|
| Back to top |
|
|
vasanthz
Global Moderator
Joined: 28 Aug 2007
Posts: 1742
Location: Tirupur, India
|
|
|
|
| Quote: |
Norton warned me again this evening.
|
I agree that there is no https for this site, but Obviously Norton is wrong here, we already know that this site has clean content. By chance even if there were any malware implanted as drive-by attacks, still Chrome would alert users.
Chrome by itself would warn people of suspicious sites, which it does not.
Personally I think Norton is crap. Vanilla Windows Defender is much better. |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
|
|
| Nic Clouston, Please send me a screenshot in PM. I will look into it. |
|
| Back to top |
|
|
Nic Clouston
Global Moderator
Joined: 10 May 2007
Posts: 2455
Location: Hampshire, UK
|
|
|
|
Next time it happens, it did not happen today, I will do that.
BTW. I am using Firefox 61.0.2 64 bit. |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
|
|
We are on HTTPS protocol now.
We are also working on to enable HSTS and the Mobile Friendliness. |
|
| Back to top |
|
|
steve-myers
Active Member
Joined: 30 Nov 2013
Posts: 917
Location: The Universe
|
|
|
|
Yes, I see it's "secure" which is good.
What is HSTS and if Mobile friendly is not what I think it is, what is it? Since I do not own a "smart" phone and my personal cell phone doesn't do data being mobile friendly is meaningless to me. Of course my daughter calls me a Luddite! Not that she really knows the history of the term.
Is HTTPS going to extend to ibmmainframeforum? I just went there and found it was not "secure." |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
|
|
HSTS is the next level of transport layer security. When a site implements HTTPS protocol, the transformation from HTTP to HTTPS happens in the sever level (usually we do a forced 301). The issue here is, all the HTTPS servers are extremely vulnerable to the man-in-the-middle-attack(MITM) due to those milliseconds delay in the 301/302 redirect.
But with HSTS, the redirect happens in the user's(/hacker's) browser itself. HSTS forces browsers to load over HTTPS, so even if you try loading the HTTP version of a website, the HTTP request gets ignored in the browser itself and send as an HTTPS request to the server.
Mobile Friendliness is making a website "also" readable/usable in mobile devices. It doesn't affect the desktop usability in anyway. Use this tool to test the mobile friendliness of a website |
|
| Back to top |
|
|
mcmillan
Site Admin
Joined: 18 May 2003
Posts: 1210
Location: India
|
|
| Back to top |
|
|
|
|
