CC Site Not Secure / Cookies

[cycleguy55]

Google Chrome is reporting the site is "Not secure", as it's using HTTP, rather than HTTPS. I can 'force' a page to HTTPS by entering it in the URL, but any clicked links open using HTTP. Even the login page is using HTTP, meaning usernames and passwords are communicated without encryption and therefore vulnerable to sniffing and 'man in the middle' techniques.

At what point is HTTPS going to be fully implemented and HTTP removed?

Also worth noting is there are 12 cookies set when opening the 'New Posts' page. 12?? Is that many really necessary?

• "clubcobra.com": 8
• "www.clubcobra.com":[/url] 3
• "noojglkidnpfjbincgijbaiedldjfbhh" (????): 1 (see image at link below)

https://www.amazon.ca/clouddrive/sha...v5PdeSHxiEG1K9

What are others seeing?

[twobjshelbys]

This site is way behind the times with respect to modern net practices. The only real exposure is your login password is sent clear text. With no ecomerce there's little exposure unless you share your username/password at other locations [hint, change it unique here]. I use the same login over multiple forums but if someone wants to steal my username/password and post here, more power to them. Of the 5 car forums I monitor regularly (in that they have a tab in this window) only one is using HTTPS.

[patrickt]

There's nothing here worth securing with an SSL. And implementing it would just be one more thing to break, expire and set off flags with your browser, etc. I think you should be more concerned that your neighbor is spoofing ARP packets on your home network and diverting all your traffic over to his house where he is setting up a Man In The Middle attack with a self signed certificate that looks like your bank account log in.

[cycleguy55]

Originally Posted by patrickt

There's nothing here worth securing with an SSL. And implementing it would just be one more thing to break, expire and set off flags with your browser, etc. I think you should be more concerned that your neighbor is spoofing ARP packets on your home network and diverting all your traffic over to his house where he is setting up a Man In The Middle attack with a self signed certificate that looks like your bank account log in.

Glasswire looks for and reports ARP spoofing. Regardless, my neighbours are far enough away that they see a pretty weak WiFi signal.