Not Secure

[John B.]

I'm getting the message that the Matrix site is not secure. Am I missing something on this?

[zakblood]

no that's normal, it just means it's an unencrypted connection, a strategy designed to spur web developers to embrace HTTPS encryption, which apart from the store on the site, is enabled of course but not needed elsewhere as no data which can be tampered or saved or altered with is needed to be encrypted.

[John B.]

Thanks!

[RichG]

ORIGINAL: zakblood

no that's normal, it just means it's an unencrypted connection, a strategy designed to spur web developers to embrace HTTPS encryption, which apart from the store on the site, is enabled of course but not needed elsewhere as no data which can be tampered or saved or altered with is needed to be encrypted.

Zakblood, while you are correct about the store connections being encrypted, there is serious problem in that the forum login is not encrypted, which means the passwords are transmitted in plain text. Given that our forum and store login details are the same, this potentially allows for our accounts to be hacked easily through man-in-the-middle attacks or other malicious means.

In this day and age this shouldn't be accepted, and should be fixed asap.

[zakblood]

unless your doing this on someone else's wifi, i can't see the problem tbh, first they would need you to login while there and then save the data and recover it, while it's not impossible for that to happen, more often than not it's someone there in the same room with a wifi sniffer with software enabled to grab the process on the fly, and yes while encrypted would stop this, most have more sense to login anywhere in public, or should have.

but it's not my call, i'm not staff or part of the staff, so my answer was per question, not if i agree or disagree with how the site it run or used.

most accounts get hacked by poor passwords or badly patched operating systems and flaws in user behavior, with more knowledge and safer surfing habits, most will be fine, like 99% etc imo, maybe wrong, it's just my opinion

[RichG]

unless your doing this on someone else's wifi, i can't see the problem tbh

Unfortunately, man in the middle attacks are not restricted to wi-fi. It could be malware running at the web hosting company that Matrix use (often due to servers being hacked), or possibly even at the users ISP (who aren't always immune to malicious staff members). These issues do occur, probably far more often than were are ever told.

most accounts get hacked by poor passwords or badly patched operating systems and flaws in user behavior

User behaviour is by far the biggest security issue anywhere, but this concern we talk about here can be fixed pretty easy by Matrix if they cared.

[zakblood]

sorry this is where i'll step out of it, if you wish to say something to the forum / company owners, i'm not the gun to fire the bullet[:'(]

[Mobeer]

There's also a general idea that if you encrypt everything then sensitive data is hard to find. If you just encrypt one communication then its pretty obvious that is more valuable than average.

[Cataphract88]

Fix this Matrix/Slitherine, apart from anything else it doesn't look very professional.

[PipFromSlitherine]

It's very hard to do for sites like forums are it to some extent requires everything that they link to to be HTTPS as well. It is on the long list of server upgrade requests

Cheers

Pip