SSL for login: I will donate $50 to make it happen

[Reptile]

Besides SSL, how about an audit page?

That will tell us all the IP addresses (city, state, country) that were used to log into my account.

If I see something bizarre, I'd know my account was hacked.

Better yet, 2 Step Verification.

I ONLY use a couple computers and my phone for NES.

I'd like to lock out all others but keep a "key" - 2 Step Verification- in case I am on vacation in a secure location.

 

[sixtiesstill]

Just log into Go Daddys website, it's easy and cheap. There are others out there, but that is a starting point for information.

Sent from my SM-P600 using Tapatalk

 

[fshalor]

Nginx + SSL certs. Ftw.

 

[drgrant]

As an entrepreneur, I've found that a great litmus test for the viability of an idea is when the average expert vehemently rejects the idea, then you know you are on to something.

Depends on what the field and who the expert is. In this case, the only benefit is for the tinfoil hat club crypto fetish more than anything else.

 

[SemiAutoSam]

You rang? To the OP and unless Derek has objection maybe a poll to see how much the membership would support this move ?

How much would it add to yearly membership cost?

Depends on what the field and who the expert is. In this case, the only benefit is for the tinfoil hat club crypto fetish more than anything else.

 

[fshalor]

$60-$250/year for a cert, depending on options and features. I've set some small businesses up with quite good options for around $110/year for 3 years. The cheapies can be a pain.

 

[ThePreBanMan]

Digicert's standard SSL certs are affordable and very easy to install w/ a tool they provide. It also installs the intermediate and root certificates if needed. Support is excellent.

 

[cmc]

Any traction on this? SSL certs are pretty inexpensive and easy to implement

 

[sHORTY]

Still working out some kinks, but https://www.northeastshooters.com/vbulletin/forum.php should work... mostly.

NOTE: There are some hard-coded links still that will dump you back to regular http. I'll work on setting these to relative over the next couple of days as time permits.

 

[Kevin_NH]

Any traction on this? SSL certs are pretty inexpensive and easy to implement

Wow, you really get results when you ask for something! 98 minute turnaround time!

 

[sHORTY]

I believe I cleaned up the last of the non-relevant links. I'm going to test it out for the next few days before announcing it beyond this thread or making it default...

Let me know if you guys find anything still pointing back to the non-secure side.

 

[KMM696]

Only glitch I've seen is in Feedback. I was leaving feedback, and the field for the deal thread rejected the hyperlink as invalid until I removed the 's' from http.

 

[Navy Moose]

For shits and giggles I decided to add https to the start of the address and I saw the lock icon, indicating in Safarai that I'm on a secure connection. When I cliced onto this thread, the lock icon disappeared.

Is this normal for Safarai? I'm running an iPad2 with iOS 8.4.0

 

[Kevin_NH]

HTTPS Everywhere

I use EFF's HTTPS Everywhere plugin for Chrome, Firefox and Firefox/Android to force the site to SSL. I had to manually add a rule to force all of NES to always use HTTPS even on my old bookmarks, etc.

 

[sHORTY]

For shits and giggles I decided to add https to the start of the address and I saw the lock icon, indicating in Safarai that I'm on a secure connection. When I cliced onto this thread, the lock icon disappeared.

Is this normal for Safarai? I'm running an iPad2 with iOS 8.4.0

I have every link pointing to HTTPS by default now. There is the possibility of a linked image, or something along those lines to remain non secure. If anyone can find out what elements are showing up as insecure, I'll look into it.

 

[cmc]

I have every link pointing to HTTPS by default now. There is the possibility of a linked image, or something along those lines to remain non secure. If anyone can find out what elements are showing up as insecure, I'll look into it.

If I load up https://www.northeastshooters.com or https://northeastshooters.com, I get taken to http://www.northeastshooters.com/vbulletin/content/

Can you configure the web server itself to force a 301 redirect to HTTPS if HTTP is detected? Looks like nginx with some kind of cloudflare integration?

 

[sHORTY]

If I load up https://www.northeastshooters.com or https://northeastshooters.com, I get taken to http://www.northeastshooters.com/vbulletin/content/

Can you configure the web server itself to force a 301 redirect to HTTPS if HTTP is detected? Looks like nginx with some kind of cloudflare integration?

All set, I missed that redirect.

And to answer the question - Litespeed with cloudflare.

To clarify, I'm not going to set the entire site to force SSL - people can still utilize regular HTTP if desired. However, the default is now SSL.

 

[warwickben]

Not trolling but any one want to explain lol

 

[cmc]

All set, I missed that redirect.

And to answer the question - Litespeed with cloudflare.

To clarify, I'm not going to set the entire site to force SSL - people can still utilize regular HTTP if desired. However, the default is now SSL.

Looks good!

 

[Reptile]

Awesome!!!

Who do I send the $50 to!!!

 

[atilla]

Awesome!!!

Who do I send the $50 to!!!

$25 finder's fee to me, $25 donation to comm2a?

 

[CTpatriot]

Derek,

If you can get a secure SSL set up for logins, I will donate $50 for the cause.

Let me know...

what about requiring paswords to be a minimum length of X with at least 1 cap, 1 lower, 1 number and 1 special character. would this not raise the odds of not being cracked easily.

 

[sHORTY]

what about requiring paswords to be a minimum length of X with at least 1 cap, 1 lower, 1 number and 1 special character. would this not raise the odds of not being cracked easily.

I'm not a fan at all of forced password security. All it does is make people write down their password, or store it in some other less secure method. As a whole, I'll do everything in my power to keep things secure here, but individual security is up to the individual.

 

[atilla]

I'm not a fan at all of forced password security. All it does is make people write down their password, or store it in some other less secure method. As a whole, I'll do everything in my power to keep things secure here, but individual security is up to the individual.

this.

 

[Len-2A Training]

I'm not a fan at all of forced password security. All it does is make people write down their password, or store it in some other less secure method. As a whole, I'll do everything in my power to keep things secure here, but individual security is up to the individual.

Ahh, that old "personal responsibility" deal again. Not sure that most folks can deal with that anymore!

 

[drgrant]

what about requiring paswords to be a minimum length of X with at least 1 cap, 1 lower, 1 number and 1 special character. would this not raise the odds of not being cracked easily.

This is called "creating an administrative nightmare". Strong passwords are a good thing but forcing them in most cases ends up in a decrease in security when people save them more often, put them on post-it notes, etc.

-Mike

 

[sHORTY]

This is called "creating an administrative nightmare". Strong passwords are a good thing but forcing them in most cases ends up in a decrease in security when people save them more often, put them on post-it notes, etc.

-Mike

Exactly. I'm personally a fan of password managers IE: Dashlane, Lastpass, etc.

I have absolutely no idea what my password is for this, or almost any site, except for work-related things where I end up going with the default of incrementing a number on this insanely stupid long password every 30 days when I change it.

 

[Reptile]

$25 finder's fee to me, $25 donation to comm2a?

The money is suppose to go toward the effort and expense on account of Derek, Shorty, and any required fees.

Shorty, please run this by Derek and let me know where to send the $50.

I would put it toward Comm2a in the name of NES if requested!

 

[sHORTY]

The money is suppose to go toward the effort and expense on account of Derek, Shorty, and any required fees.

Shorty, please run this by Derek and let me know where to send the $50.

I would put it toward Comm2a in the name of NES if requested!

There were no additional expenses put toward this - I would vote you go with a charitable donation if you feel the need.

 

[warwickben]

What is ssl