Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

#93594 24-Nov-2011 18:00
Send private message

I have switched the PM pages (message composing, reading and listing) to accept SSL connections by default, and switch to SSL on non-secure requests.

Many reasons for that. You will know why, no need to ask.




Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
codyc1515
1598 posts

Uber Geek
Inactive user


  #549794 25-Nov-2011 09:44
Send private message

Why is it not possible to have site wide SSL? The login page is in SSL, this means that virtually everything else can be too (except, maybe, ads).



freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #549795 25-Nov-2011 09:45
Send private message

There, you answered your question.

Think about. It's not all our content. There are sometimes third party content such as speedtest images that will make your browser throw a tantrum for mixed content.

Also, why bother with SSL for a whole site if there's nothing sensitive in those other areas?
 




Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


codyc1515
1598 posts

Uber Geek
Inactive user


  #549798 25-Nov-2011 09:47
Send private message

Its the question of session jacking. Maybe make it a feature for subscribers only?



freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #549803 25-Nov-2011 09:50
Send private message

I've edited your post. No need to quote a full post just above yours.

Answering your question, what can be achieved with session hijacking really? Impersonating someone on a forum? It's not as bad as impersonating someone on your banking site.

For that we already have the IP Change option in your profile. If we detect your session is being used from a different IP address we will terminate it. You can also easily click the link in your profile page to terminate ALL existing session, for all browsers.





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


codyc1515
1598 posts

Uber Geek
Inactive user


  #549806 25-Nov-2011 09:51
Send private message

Not if your in a Cafe and all share the same external IP.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #549808 25-Nov-2011 09:53
Send private message

*le sigh*

You can just logout as soon as you're done, and anyone else using the same session will be logged out too.

Using SSL site wide would impact our revenue. There's an obvious problem there - we can't run a site full time with no revenue.




Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #549812 25-Nov-2011 09:55
Send private message

Also, instead of focusing on how this make things better for people relying on Geekzone PM to communicate (transactions between members, employee confidentiality) you worry about something that would have less impact...





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


 
 
 

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.
codyc1515
1598 posts

Uber Geek
Inactive user


  #549817 25-Nov-2011 09:59
Send private message

The whole performance impact thing has been proven wrong for quite some time now:

"In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that."

As for revenues I'm not quite sure how that comes into it if its just for Subscribers. What I'm getting at is that someone could go into a Cafe have their session jacked on an ordinary page and send PMs as that user, without them knowing (most likely).

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #549819 25-Nov-2011 10:01
Send private message

If you read the thread again you will see I never mentioned the performance card, as I am well aware of the impact or non-impact of it. Please don't put words in my mouth.

As for "for subscribers only", I'm sorry but we work on priorities here. The subscriber uptake is too low, and people have already said that even $5 a month is "too expensive". Not very supporting is it?





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


Ragnor
8218 posts

Uber Geek

Trusted

  #550154 26-Nov-2011 05:14
Send private message

codyc1515:  

What I'm getting at is that someone could go into a Cafe have their session jacked on an ordinary page and send PMs as that user, without them knowing (most likely).


If you are going to use shared/public internet you would send all traffic over a vpn and use your home, work/work/hosts connection to avoid any man in the middle session jacking for all sites.






codyc1515
1598 posts

Uber Geek
Inactive user


  #550401 26-Nov-2011 19:44
Send private message

Ragnor:
codyc1515:  

What I'm getting at is that someone could go into a Cafe have their session jacked on an ordinary page and send PMs as that user, without them knowing (most likely).


If you are going to use shared/public internet you would send all traffic over a vpn and use your home, work/work/hosts connection to avoid any man in the middle session jacking for all sites.

Not everybody knows this though and its a waste of bandwidth.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #550402 26-Nov-2011 19:45
Send private message

In such case I doubt they would know or worry about session hijacking either...





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


Regs
4066 posts

Uber Geek

Trusted
Snowflake

  #550404 26-Nov-2011 19:58
Send private message

freitasm: In such case I doubt they would know or worry about session hijacking either...




LOL. +1 




codyc1515
1598 posts

Uber Geek
Inactive user


  #550408 26-Nov-2011 20:14
Send private message

freitasm: In such case I doubt they would know or worry about session hijacking either...


In which case they should be protected, no?

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #550409 26-Nov-2011 20:15
Send private message

Sure. Are you paying their subscription? Because I am sure they don't care enough to pay for one. 

As I said, it comes down to priorities, planning, costs. Should we just close the site because some people won't pay for a subscription, and having SSL means ads are going to be harder to deliver, just because  some idiot may impersonate someone on a non-commerce site?







Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic





News and reviews »

Air New Zealand Starts AI adoption with OpenAI
Posted 24-Jul-2025 16:00


eero Pro 7 Review
Posted 23-Jul-2025 12:07


BeeStation Plus Review
Posted 21-Jul-2025 14:21


eero Unveils New Wi-Fi 7 Products in New Zealand
Posted 21-Jul-2025 00:01


WiZ Introduces HDMI Sync Box and other Light Devices
Posted 20-Jul-2025 17:32


RedShield Enhances DDoS and Bot Attack Protection
Posted 20-Jul-2025 17:26


Seagate Ships 30TB Drives
Posted 17-Jul-2025 11:24


Oclean AirPump A10 Water Flosser Review
Posted 13-Jul-2025 11:05


Samsung Galaxy Z Fold7: Raising the Bar for Smartphones
Posted 10-Jul-2025 02:01


Samsung Galaxy Z Flip7 Brings New Edge-To-Edge FlexWindow
Posted 10-Jul-2025 02:01


Epson Launches New AM-C550Z WorkForce Enterprise printer
Posted 9-Jul-2025 18:22


Samsung Releases Smart Monitor M9
Posted 9-Jul-2025 17:46


Nearly Half of Older Kiwis Still Write their Passwords on Paper
Posted 9-Jul-2025 08:42


D-Link 4G+ Cat6 Wi-Fi 6 DWR-933M Mobile Hotspot Review
Posted 1-Jul-2025 11:34


Oppo A5 Series Launches With New Levels of Durability
Posted 30-Jun-2025 10:15









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.