Skoolie.net Not Secure - Certificate Issue

WLRoadScholars · 11-08-2019, 05:22 AM

Hey folks in charge!

I'm new here but thought it was a bit odd that you've not got your certs set up (see attached screenshot for example), I figured I had just joined on a day where they had lapsed, but it's been a few days now and I see it's still not sorted out, so I wanted to point it out in case you hadn't noticed?

WLRoadScholars · 11-08-2019, 05:31 AM

Just a quick additional note that may help you out, looks like you're using Cloudflare to handle your SSL but you've not configured it correctly - are you forcing a redirect to HTTP?

Anyway, a site set up correctly with Cloudflare should give a perfect score on this particular test (see attached). Hope this helps!

PatrickBaptist · 11-08-2019, 07:03 AM

Fill in your info, curious what kinda rig you have.

cadillackid · 11-08-2019, 07:55 AM

ive never had this site run in SSL mode.. i think they just run strictly HTTP... it may be cloudflare doing the rewrites but I never worried about it since its just school bus stuff.. the password I use here is one I only use here...

-Christopher

WLRoadScholars · 11-08-2019, 08:56 AM

Quote:

Originally Posted by PatrickBaptist

Fill in your info, curious what kinda rig you have.

Hey there, happy to help!

I've accessed the site on a Win8.1 machine with Chrome on a broadband connection & an Android phone with Chrome via 4G, both are flagging as not secure. I've also checked on a Win10 VPS I'm running in France, and with a buddy in Scotland, and all responses come back the same, with the site being unsecured.

It's definitely an issue on the webserver end and on my rig

PatrickBaptist · 11-08-2019, 09:03 AM

Quote:

Originally Posted by WLRoadScholars

Hey there, happy to help!

I've accessed the site on a Win8.1 machine with Chrome on a broadband connection & an Android phone with Chrome via 4G, both are flagging as not secure. I've also checked on a Win10 VPS I'm running in France, and with a buddy in Scotland, and all responses come back the same, with the site being unsecured.

It's definitely an issue on the webserver end and on my rig

Yuck windows 8, LOL I'm still running W2k3 LOL.
I wouldn't worry about the lack of security, just make sure to use a password you don't use for anything you care about.
This just isn't the kind of site I would care anything about in regards to security, if someone hijacked it I sure wouldn't fret over it. But then again I don't even fool with anti-virus software hahaha.
Like Chris was saying, it's not running in SSL so the notion of security is kinda null.

Native · 11-09-2019, 03:17 AM

Running HTTP only is NOT "kinda null security" ... it *is not* secure by the design of the protocol. The site would have to be set up as a secure server running the HTTPS protocol with an SSL certificate.

To the OP ... you have started a thread that is a non-issue. HTTP and HTTPS are different animals.

PatrickBaptist · 11-09-2019, 09:43 AM

Quote:

Originally Posted by Native

Running HTTP only is NOT "kinda null security" ... it *is not* secure by the design of the protocol. The site would have to be set up as a secure server running the HTTPS protocol with an SSL certificate.

To the OP ... you have started a thread that is a non-issue. HTTP and HTTPS are different animals.

Forgive me for saying "kinda". You are preaching to the choir on it bud.

Native · 11-09-2019, 02:55 PM

Quote:

Originally Posted by PatrickBaptist

Forgive me for saying "kinda". You are preaching to the choir on it bud.

I was tinking that was the case, but really wanted to make sure everyone understood the difference.

Neorush · 11-10-2019, 08:26 PM

Really no reason not to run https. Letsencrypt.org makes it completely free. Certbot on linux will even keep everything renewed and upto date automatically.

kazetsukai · 11-10-2019, 09:00 PM

Quote:

Originally Posted by Neorush

Really no reason not to run https.

+1

This last year, I've taken many steps to anonymize my traffic and make myself difficult to track. With HTTP, someone sniffing network traffic can see what pages you are viewing. With HTTPS, they cannot. At best they can see a DNS request for the domain (DoH, VPN or onion routing mitigate this).

Personally I think HTTP should be disabled/redirect to HTTPS, as it helps prevent (not a cure-all, but makes it harder to) snoop on visitor traffic. Also any logins over HTTP compromise the account- passwords are sent over in plaintext (or hashed- but the hash is as good as the password for accessing the account).

You may also like: