topic "Insecure Discussion Forums “Login” link" in Community Site Feedback

"Insecure Discussion Forums “Login” link"

Madeleyite — Mon, 21 Mar 2016 16:36:31 GMT

Are members aware that the Discussion Forums “Login” link is insecure if using the Plusnet Login link?
Plusnet Home page = https://www.plus.net/ = Secure
Member Centre = https://portal.plus.net/index_nlp.html = Secure
Discussion Forums = http://community.plus.net/forum/ = OK for viewing only.
Clicking on the Discussion Forums link “Login” takes me to: - http://community.plus.net/forum/index.php?action=login = Not secure.
I have created a favourite/bookmark (I should not have had to do this) to take me to https://community.plus.net/forum/index.php?action=login
How many people are logging in to the Plusnet Community Site forums using the Plusnet provided “Login” link taking them to the insecure login page and then entering their username and password?
I have only been with Plusnet since February so how long has this breach been happening for and are Plusnet aware of it and sorting it?
Not good.

Re: "Insecure Discussion Forums “Login” link"

Oldjim — Mon, 21 Mar 2016 16:41:27 GMT

Why should it use https - checking on the multiple forums I use and I only found one using it

Re: "Insecure Discussion Forums “Login” link"

dvorak — Mon, 21 Mar 2016 16:43:23 GMT

https works fine on the forum..

Re: "Insecure Discussion Forums “Login” link"

Oldjim — Mon, 21 Mar 2016 16:46:12 GMT

but you have to change it yourself as linking from the main site doesn't use it

Re: "Insecure Discussion Forums “Login” link"

jab1 — Mon, 21 Mar 2016 16:50:14 GMT

Dunno, Jim - I logged into the forums so long ago I can't remember which link I used, but my header definitely reads 'https://'

Re: "Insecure Discussion Forums “Login” link"

Mav — Mon, 21 Mar 2016 17:36:29 GMT

No http ot https shown in FF here but clicking on the little 'i' to the left of the address bar and I get a message that 'Connection is not secure'.

Re: "Insecure Discussion Forums “Login” link"

bobpullen — Mon, 21 Mar 2016 21:25:11 GMT

Are you sure that's not just telling you certain items on the page are insecure Mav? Things like externally hosted images in signatures blocks/avatars probably won't be.
The login link should force SSL IMO and I believe it will when the community gets upgraded in the not too distant future.

Re: "Insecure Discussion Forums “Login” link"

Mav — Tue, 22 Mar 2016 00:36:01 GMT

Not sure so I've attached a screenshot:

Re: "Insecure Discussion Forums “Login” link"

w23 — Tue, 22 Mar 2016 09:26:17 GMT

As a publicly viewable site I guess having HTTP access makes some sense but I can't help thinking the login page, at least, should be HTTPS only.
What are the real risks of entering a username and password on a plain HTTP page? (I ask because I genuinely don't really know)
In case anyone wants to state the obvious that unique usernames and passwords should be used for every different sites, we all probably know someone who doesn't do this so shouldn't all login pages be secure by default?

Re: "Insecure Discussion Forums “Login” link"

bobpullen — Sat, 02 Apr 2016 11:06:39 GMT

New community's going live next week so this will become a non-issue (from a login perspective). @Mav, you're browsing over HTTP by the looks of things. You can force HTTPS by manually prefixing the URL with 'https://'.

Re: "Insecure Discussion Forums “Login” link"

Mav — Sat, 02 Apr 2016 11:14:03 GMT

A bit moot now, really, but I have just added https:// before the URL.
I get a padlock with a red line through it and right-clicking still gives me a message 'Connection is not secure.'.
Not worth investigating but thought I'd post my results.

Re: "Insecure Discussion Forums “Login” link"

dvorak — Sat, 02 Apr 2016 12:05:08 GMT

There are some unsecured scripts

Re: "Insecure Discussion Forums “Login” link"

w23 — Sat, 02 Apr 2016 19:26:48 GMT

Will the new site login page be https by default?

Re: "Insecure Discussion Forums “Login” link"

ejs — Sat, 02 Apr 2016 19:32:10 GMT

The entire site should be https by default. Otherwise, your login cookie would be exposed the same way as the username and password would be if the login page isn't https.