Secure Connections

Rushy · « **on:** September 14, 2014, 04:38:48 AM »

As I'm not technically inclined to networking, how difficult would it be to have some form of secure connection, such as SSL/HTTPS? I can't login to the site from certain terminals because they run through a server that will reject unencrypted connections.

xasop · « **Reply #1 on:** September 14, 2014, 05:45:37 AM »

This is something I've been meaning to get set up for a while. I'll try get around to it soon, if it's causing access problems.

Rushy · « **Reply #2 on:** September 14, 2014, 05:57:48 AM »

It's not a big deal, just wanted to throw it out there. I probably shouldn't be on here at work anyway.

xasop · « **Reply #3 on:** September 14, 2014, 03:22:48 PM »

This is now underway. I'd expect to have it sorted by the end of this month.

Particle Person · « **Reply #4 on:** September 14, 2014, 04:26:10 PM »

Won't performance suffer if everything is encrypted?

Lord Dave · « **Reply #5 on:** September 14, 2014, 10:10:52 PM »

Quote from: Alexandyr on September 14, 2014, 04:26:10 PM

Won't performance suffer if everything is encrypted?

Do you notice when you log into your bank?

Particle Person · « **Reply #6 on:** September 14, 2014, 10:15:57 PM »

Quote from: Lord Dave on September 14, 2014, 10:10:52 PM

Quote from: Alexandyr on September 14, 2014, 04:26:10 PM
Won't performance suffer if everything is encrypted?
Do you notice when you log into your bank?

Yes. It takes like 15 seconds.

Rushy · « **Reply #7 on:** September 15, 2014, 01:00:23 AM »

Quote from: Alexandyr on September 14, 2014, 10:15:57 PM

Yes. It takes like 15 seconds.

Do you ever login to a bank with a non-shitty website?

Particle Person · « **Reply #8 on:** September 15, 2014, 01:11:17 AM »

Quote from: Irushwithscvs on September 15, 2014, 01:00:23 AM

Quote from: Alexandyr on September 14, 2014, 10:15:57 PM
Yes. It takes like 15 seconds.

Do you ever login to a bank with a non-shitty website?

Good one. Okay, it's more like 6 or 7 seconds. It's simply a fact that load times will increase if the entire site is hosted through HTTPS. Whether or not the difference is negligible is debatable.

Lord Dave · « **Reply #9 on:** September 15, 2014, 01:25:52 AM »

Quote from: Alexandyr on September 15, 2014, 01:11:17 AM

Quote from: Irushwithscvs on September 15, 2014, 01:00:23 AM
Quote from: Alexandyr on September 14, 2014, 10:15:57 PM
Yes. It takes like 15 seconds.

Do you ever login to a bank with a non-shitty website?

Good one. Okay, it's more like 6 or 7 seconds. It's simply a fact that load times will increase if the entire site is hosted through HTTPS. Whether or not the difference is negligible is debatable.

Is performance suffering the same as negligible?

Rushy · « **Reply #10 on:** September 15, 2014, 03:41:41 AM »

Quote from: Alexandyr on September 15, 2014, 01:11:17 AM

Good one. Okay, it's more like 6 or 7 seconds. It's simply a fact that load times will increase if the entire site is hosted through HTTPS. Whether or not the difference is negligible is debatable.

Just go to one of your favorite sites and turn HTTPS on then tell me if you notice any actual latency difference. Reddit is a good example since either adding or deleting HTTPS:// before www.reddit.com will change the connection type.

xasop · « **Reply #11 on:** September 15, 2014, 03:48:37 AM »

Quote from: Alexandyr on September 14, 2014, 04:26:10 PM

Won't performance suffer if everything is encrypted?

Yes, but I don't intend to make encryption mandatory. It will be an option for those who want to use it (and possibly used by default for the registration and login forms, we'll decide that once we actually have HTTPS in place).

xasop · « **Reply #12 on:** October 01, 2014, 03:15:05 PM »

Quote from: Parsifal on September 14, 2014, 03:22:48 PM

This is now underway. I'd expect to have it sorted by the end of this month.

As you'd have noticed, this wasn't done by the end of the month. At this point, I have no direct control over the process; I'm verifying my address with the SSL certificate provider, but the thing they've sent me to confirm it hasn't arrived yet. I wouldn't expect it to be too much longer, though, and once that's out of the way it's a strictly technical process.

Particle Person · « **Reply #13 on:** October 01, 2014, 04:08:24 PM »

Let's just hope that the notorious hacker 4chan doesn't hack us in the meantime.

Pete Svarrior · « **Reply #14 on:** October 01, 2014, 04:13:23 PM »

Quote from: Particle Person on October 01, 2014, 04:08:24 PM

Let's just hope that the notorious hacker 4chan doesn't hack us in the meantime.

But I'm already here.

jroa · « **Reply #15 on:** October 02, 2014, 01:14:23 PM »

They will get you with Lunix every time; damn hackers.

xasop · « **Reply #16 on:** October 23, 2014, 01:36:38 AM »

Good news: The postal article I was awaiting has arrived, and I am now in possession of it. I should be able to set this up when I get home tonight.

xasop · « **Reply #17 on:** October 23, 2014, 12:49:15 PM »

Done:

https://forum.tfes.org/

Completely optional at this point, and some links still go to HTTP versions of pages (mainly links we've added; SMF itself seems to do the right thing here for once). Enjoy your secure browsing.

I'll put up a proper announcement if there are no major issues reported within a day or two.

Rushy · « **Reply #18 on:** October 23, 2014, 02:03:14 PM »

Quote from: Parsifal on October 23, 2014, 12:49:15 PM

Done:

https://forum.tfes.org/

Completely optional at this point, and some links still go to HTTP versions of pages (mainly links we've added; SMF itself seems to do the right thing here for once). Enjoy your secure browsing.

I'll put up a proper announcement if there are no major issues reported within a day or two.

Oh goodie, I can post at work now. You've made a terrible mistake.

Thanks.

juner · « **Reply #19 on:** October 23, 2014, 05:33:30 PM »

The heart isn't even bleeding. Thanks, Parsifal.