Security Overview

[Don Kinslow]

I've noticed that the Security Overview that I get by clicking on 'view site information' on the title bar indicates that the page is not secure. Is this something that needs attention?

[Jenny48549]

Originally Posted by Don Kinslow

I've noticed that the Security Overview that I get by clicking on 'view site information' on the title bar indicates that the page is not secure. Is this something that needs attention?

No. It just means that we do not have an SSL certificate installed. This version of vBulletin does not support SSL certificates.

[mucowag]

Jenny, this getting well past it's sell-by date. With over half a million members this
should be such a priority. I think the latest version might support it.
I am a mod on an unrelated forum. We recently switched for the security.
Not without its problems, and needs to be renewed every 90 days, but do it!

[Jenny48549]

Originally Posted by mucowag

Jenny, this getting well past it's sell-by date. With over half a million members this
should be such a priority. I think the latest version might support it.
I am a mod on an unrelated forum. We recently switched for the security.
Not without its problems, and needs to be renewed every 90 days, but do it!

We have no control over upgrades to be honest.

The biggest issue as I understand it is that we have essential plugins we use here that are not compatible with newer versions so until updated plugins are available, we're stuck with what we have.

[mucowag]

Oh Ok, no criticsm intended, but eventually it will have to happen as the net moves on.

[recluce]

Problem is that even the authentication is not using TLS ("SSL" colloquially), exposing user credentials, especially when using something like public Wi-Fi. I just hope that nobody reuses their password for VEF anywhere else.

Also, users from certain countries cannot or should not use VEF, as consuming or possessing the content we "discuss" here may have dire consequences in some locations (and I do not mean possible copyright issues). Remember, everything is sent unencrypted and in clear text - so authorities in these jurisdictions could identify interest in forbidden materials. If somebody then follows the link that was transmitted to them in clear text, it might be enough evidenc, even if the transmission of the actual files should be encrypted.

So I agree that encrypted use of VEF should be a high priority in everybody's interest. Until that happens, every user should consider using a VPN for some protection.

I hope I am not violating a rule here, but if money is needed, I would be more than happy to donate something - and I am sure that I am not the only one.

[Jenny48549]

Originally Posted by recluce

Problem is that even the authentication is not using TLS ("SSL" colloquially), exposing user credentials, especially when using something like public Wi-Fi. I just hope that nobody reuses their password for VEF anywhere else.

Also, users from certain countries cannot or should not use VEF, as consuming or possessing the content we "discuss" here may have dire consequences in some locations (and I do not mean possible copyright issues). Remember, everything is sent unencrypted and in clear text - so authorities in these jurisdictions could identify interest in forbidden materials. If somebody then follows the link that was transmitted to them in clear text, it might be enough evidenc, even if the transmission of the actual files should be encrypted.

So I agree that encrypted use of VEF should be a high priority in everybody's interest. Until that happens, every user should consider using a VPN for some protection.

I hope I am not violating a rule here, but if money is needed, I would be more than happy to donate something - and I am sure that I am not the only one.

See post above for the reasons. Money is not the issue.

Users that have issues with material being forbidden in their countries most likely have to use VPN or proxies to even access VEF. Also if you stay logged in when not on the site, there are no credentials being exposed because the data is not transferred.

Any files downloaded from filehosts are done so using SSL so that should not be a problem as we do not host any material.

[JishWa]

I known this is an older thread, but the need for secure HTTPS is more relevant than ever, particularly with a site like this. Is there any update on the plugins and vbulletin upgrade issues?

[Scott T]

Originally Posted by JishWa

I known this is an older thread, but the need for secure HTTPS is more relevant than ever, particularly with a site like this. Is there any update on the plugins and vbulletin upgrade issues?

The 502's thread mentioned as a side comment following the downtime last month (or was it March) an indication of when the various sites have been/will be moved from vBulletin to XenForo.

[JishWa]

Originally Posted by Scott T

The 502's thread mentioned as a side comment following the downtime last month (or was it March) an indication of when the various sites have been/will be moved from vBulletin to XenForo.

Interesting, thanks. I searched and came up with this thread http://vintage-erotica-forum.com/showthread.php?p=6660219

It would be great to get an update from someone senior who has any knowledge of the timeline for this migration. VEF is a great forum and it would be good for it to provide a more privacy and security-conscious platform that will allow https connections.