The site is still not completely TLS exclusive. - Page 1
Forum section: electronics / general

author: technix
author_rank: Super Contributor
timestamp: March 31, 2017, 12:55:43 pm
content: There are still some elements not served through encrypted means. @EEVBlog please check your advertising code and upgrade those to ones requiring TLS too, or the pages can still be hijacked despite the site itself is mandating TLS.

author: PointyOintment
author_rank: Frequent Contributor
timestamp: April 01, 2017, 02:08:04 am
content: I use the Chrome extension KB SSL Enforcer. In the past it has for some reason stopped enforcing HTTPS on this site, despite me repeatedly telling it to. It has always worked fine on all other sites. I tried again the other day and it seems to have stuck. However, the background image (the pattern of holes) was not served securely, so that stopped working (resulting in white background) until I told Chrome to "load unsafe scripts" and my other extension uMatrix to not enforce strict HTTPS. This resulted in Chrome telling me the page was not fully secure, of course. As soon as I did that and loaded again, though, it was full HTTPS, with the background working—maybe the background was cached by Chrome and therefore didn't need to be loaded again?

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 02:38:51 am
content: Quote from: technix on March 31, 2017, 12:55:43 pmThe last I heard, this site does not mandate TLS. The encryption you receive here is only between your browser and CloudFlare's caching servers. The connection from CloudFlare to the EEVblog server is not encrypted, even if your browser says otherwise. CloudFlare is proving the encryption, not EEVblog.i.e.,Browser <--- HTTP ---> CloudFlare <--- HTTP ---> EEVblogBrowser <--- HTTPS ---> CloudFlare <--- HTTP ---> EEVblog

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 02:44:16 am
content: Scratch that. I just saw this:https://www.eevblog.com/forum/news/server-ssl-upgrade/Things, they are a changing!

author: raspberrypi
author_rank: Frequent Contributor
timestamp: April 01, 2017, 03:12:18 am
content: Quote from: PointyOintment on April 01, 2017, 02:08:04 amI always thought that chrome was just an easy way for google to spy on you then neatly package your personal info to sell to advertisers.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 03:17:09 am
content: Quote from: raspberrypi on April 01, 2017, 03:12:18 amWhich is why I use Chromium, it's Chrome before its altered by Google with all their crap to become Chrome.

author: raspberrypi
author_rank: Frequent Contributor
timestamp: April 01, 2017, 03:27:11 am
content: Quote from: gnif on April 01, 2017, 03:17:09 amThis site probably uses hostfission; a shit web server service that every time I call technical support its down because they are "upgrading the servers". Place must buy servers that run on double A batteries with bateroo's on them.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 05:20:03 am
content: Quote from: raspberrypi on April 01, 2017, 03:27:11 amI am sorry, is that a personal attack? For the record you are not one of my clients, nor have I had any calls to my technical support line of the sorts.Edit:Thank you Dave/Simon, someone banned this guy for trolling, not sure if it was in relation to the above post or not.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 05:28:45 am
content: Quote from: PointyOintment on April 01, 2017, 02:08:04 amJust to clear things up, yes there was an issue here with the URL, it was absolute and specified HTTP, I corrected this among many other bad URLs for HTTPS, including the embedded advertising.I have configured the server so that If your browser sends the header 'Upgrade-Insecure-Requests: 1' in it's request (most modern browsers do), the server will redirect you to the HTTPS address instead of serving you the content insecurely, there is no need for a force SSL for this website anymoreEdit:Actually there are a few image issues still to resolve when I next find a free chunk of time, but other then that it is all working

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 05:30:16 am
content: Yep, it's been working well after all the time you spent tweaking it today, gnif. Thanks!Edit: Ah, yes. Just saw that the regular smiley you added was not encrypted. Getting close!https://www.eevblog.com/forum/Smileys/default/smiley.gif

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 05:35:05 am
content: Quote from: gnif on April 01, 2017, 05:28:45 amMaybe set the HTTP Strict Transport Security too? This will not only redirect supported browsers to HTTPS, it tells them to keep using HTTPS in subsequent visits and not even bother with HTTP at all.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 05:37:09 am
content: Quote from: technix on April 01, 2017, 05:35:05 amHah, not a chance! Every embedded image from non https websites would break. Simply not suitable for the content of this forum.

author: EEVblog
author_rank: Unknown
timestamp: April 01, 2017, 06:29:20 am
content: Quote from: technix on March 31, 2017, 12:55:43 pmI am not concerned that the ads are going to be hijacked.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 06:32:28 am
content: Quote from: EEVblog on April 01, 2017, 06:29:20 amThis is no issue either as I fixed these when I set things up yesterday.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 06:42:17 am
content: Quote from: gnif on April 01, 2017, 05:37:09 amNot really. If the website is marked with HSTS the browser will go straight for https regardless the original link being http or https. Not even requiring a redirect for this to work.Also you need to check this:https://www.ssllabs.com/ssltest/analyze.html?d=www.eevblog.com&latest

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 06:43:22 am
content: Quote from: technix on April 01, 2017, 06:42:17 amYou missed the point, many people embed links to images from other websites that do not have HTTPS, these will break if we use HSTS.QuoteWe do not terminate SSL, CloudFlare does, we are not in control of this.SSL was not put on the website for security, this forum doesn't really need it, it was put on simply for SEO and to keep the paranoid happy.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 07:01:17 am
content: Quote from: gnif on April 01, 2017, 06:43:22 amIf the images are not from *.eevblog.com the HSTS settings here will not affect it, unless the site pointed to also have HSTS on.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 07:11:38 am
content: You are correct, I was mixed up with the server side 'Content-Security-Policy: upgrade-insecure-requests' header that causes this behavior. Even still HSTS is not warranted here as not everyone cares to use HTTPS with this website, nor should they.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 07:20:27 am
content: Quote from: gnif on April 01, 2017, 07:11:38 amHSTS silently upgrades everyone to HTTPS and makes sure it stays that way. It also catches the odd image that you forgot to upgrade the link to.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 07:23:05 am
content: It isn't silent if people do not want HTTPS, there are many reasons to not use HTTPS, and there is no critical sensitive information on this site that requires forcing HTTPS, this topic has been discussed extensively in the past, the general consensus is to have it optional. HSTS is of no use here, I just need to fix the website up to serve the correct scheme.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 08:03:34 am
content: Quote from: gnif on April 01, 2017, 07:23:05 amThen folks will start seeing Keysight or Bryman ads appearing on all websites they visit.

author: Monkeh
author_rank: Super Contributor
timestamp: April 01, 2017, 09:09:52 am
content: Quote from: technix on April 01, 2017, 08:03:34 amYes, that's how ads work - what's the problem?

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 09:56:05 am
content: Quote from: Monkeh on April 01, 2017, 09:09:52 amI meaneven with adblocks onadvertisers would still know.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 10:02:22 am
content: Quote from: technix on April 01, 2017, 09:56:05 amUmm, Dave runs ads here to feed his family, most of us out of support for Dave do not block the ads on this website, and the ads he does run, are non intrusive. In short, we are ok with it... its just the odd person. Remember Dave runs the forum, website, videos, out of his own pocket, this is his full time job, the least we can do is put up with a few ads.Edit:Btw the ads are served via HTTPS anyway, so I don't know what your issue is. The few images of concern are the simily faces in posts....

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 01:02:32 pm
content: Quote from: gnif on April 01, 2017, 10:02:22 amThe problem is that with the latest ruling in the US, the ISP will allow advertisers know that you are a electronics engineer, regardless of your willingness of ISP tracking you, despite you run Adblock,plainly because you are frequenting EEVblog, if the advertiser is willing to pay. That is the scary part.As of me, I have to run my browser with AdBlock and a lot of extra security features. It is wide and public that my ISP, China Telecom, is long doing this since 2014 or the like. And Chinese ISP is mandated to send all my Internet traffic to the cops for tab keeping. I definitely have to do something to obscure my traffic to keep the big brother out.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 01:04:11 pm
content: Quote from: technix on April 01, 2017, 01:02:32 pmNot my concern, ads are served via HTTPS, HTTPS must be optional, there is nothing to discuss here.

author: ebclr
author_rank: Super Contributor
timestamp: April 01, 2017, 01:10:38 pm
content: Simple use anonymous mode, and a VPN and Tor on topThis will help to be anonymous, I don't know why you want that here, but will

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 01:12:15 pm
content: Quote from: gnif on April 01, 2017, 01:04:11 pmIt is not the ads. It is the plain visiting EEVblog that allows ISP to track.Speaking of the ads, ISP can scrub Dave's ad code and replace it with their own if they want to (and China Unicom have done that) without mandatory HTTPS. That is no different, if not worse, than Adblock, as not only Dave is missing revenue, forum readers can be misled by the ISP's ads. Even worse, when the ISP's ad server is compromised and started to serve malware...

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 01:18:49 pm
content: Quote from: technix on April 01, 2017, 01:12:15 pmThen don't visit the website... And for that matter, what is stopping them from removing the HSTS header in an unencrypted connection anyway? Your argument doesn't fly, please kindly go and be paranoid elsewhere.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 01:30:38 pm
content: Quote from: gnif on April 01, 2017, 01:18:49 pmAt least on my website (and Google's, and Facebook's, etc) if you connect to it from HTTP, you get a HTTP 302 Redirect to the HTTPS version along with a HSTS flag. ISP can scrub the HSTS header but the 302 is not going away. (If the ISP decided to proxy the connection and terminate HTTPS on their routers, you got bigger problems.) Now your browser is being told to go to the HTTPS version which ISP generally have no way to tamper. By this time the HSTS flag arrives and will stick.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 01:32:25 pm
content: Quote from: technix on April 01, 2017, 01:30:38 pmAs stated again and again, your augments are mute, we can not, and will not force HTTPS on the user base, now stop wasting my time.

author: Ian.M
author_rank: Super Contributor
timestamp: April 01, 2017, 02:21:25 pm
content: You are currently pushing https at users who don't want it.On any forum http page, the links 'Show new replies to your posts.' and 'Show unread posts since last visit.' lead to 'https://www.eevblog.com/forum/unreadreplies/'and 'https://www.eevblog.com/forum/unread/'respectively. Also all the links on the topic list page number navigation bars:'Pages:  2 3 4 5 6 ... 593 Next (Go Down) (New Topic) (New poll) (Notify) (Mark Read) (Search)' lead to the https version, as do user name links.This makes the site nearly unusable for anyone who CAN'T use encryption for whatever reason.Currently to stay on the http pages I have to use a Greasemonkey script to rewrite all 'https://www.eevblog.com/forum/'links to http.Please fix it!

author: ebclr
author_rank: Super Contributor
timestamp: April 01, 2017, 02:44:54 pm
content: Are you kiddingJust because you are the unique guy on the planet that can't use encryption, you want that they change just for you?This is your problem, not theirs, find out a way, or simply does not access the forum

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 03:15:36 pm
content: Quote from: Ian.M on April 01, 2017, 02:21:25 pmThere are some issues still yet to resolve, I am yet to find time to do it, please be patient, we know its not complete yet.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 03:45:38 pm
content: Quote from: gnif on April 01, 2017, 01:32:25 pmWell I decided to reach out and ask.http://serverfault.com/questions/841954/is-there-any-reason-not-to-enforce-https-with-strong-cipher-on-a-websiteWell it seem to me that people is okay with dropping the very few users that cannot use strong cryptography, while keeping the folks with slightly newer equipment safe. By the way, by default, there is a big login field on every page...

author: ebclr
author_rank: Super Contributor
timestamp: April 01, 2017, 03:53:19 pm
content: Nobody is safeNSA can decrypt in less than a milisecond

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 03:55:30 pm
content: There will be fixes/changes, but when depends on my available time, that said, I am no longer following this thread as it has devolved into an argument I couldn't care less about.

author: Ian.M
author_rank: Super Contributor
timestamp: April 01, 2017, 04:02:04 pm
content: Quote from: gnif on April 01, 2017, 01:32:25 pm@Technix & Ebclr,Why are you so keen to force other users to choose between meeting the security standards you prefer or possibly abandoning this forum?If other users choose to use the http pages it doesn't expose any data relating to your activity here that isn't already either indexed by google or trivially available by registering for a free account here.Gnif is already committed to providing the most secure forum experience he canFOR THOSE THAT WANT ITwithin his time and budgetary constraints.If you want your input on forum security to have greater weight, put your money where your mouth is: Negotiate a sponsorship agreement with Dave that pays Gnif commercial rates!

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:03:20 pm
content: Quote from: ebclr on April 01, 2017, 03:53:19 pmAt least burn some of their CPU before they can read those. Running cryptoanalysis costs CPU for them at least as much as us.

author: IanB
author_rank: Super Contributor
timestamp: April 01, 2017, 04:10:36 pm
content: Quote from: technix on April 01, 2017, 01:02:32 pmWell then it sucks to be them, since I am not an electronics engineer, and nor are many others here.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:19:25 pm
content: Quote from: Ian.M on April 01, 2017, 04:02:04 pmPost your login password here, now, if you don't want to use TLS. You don't want to do that, do you? Then try upgrade your browser and move to HTTPS.Logging intoanythingwithout TLS is absolutely equivalent to posting your password here. Anyone want to see it would be able to sniff it off the network. And if you have already logged in the session cookie can be sniffed to impersonate you. Whenever you are using any public Wi-Fi anyone on the same network can sniff your traffic trivially.Even worse, once someone grabbed your password they can try guess account names of yours and attempt logging in using that password. Do you use the same password for a few account? Poof those are gone.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:25:45 pm
content: Quote from: gnif on April 01, 2017, 03:55:30 pmGoogle have a good tutorial on how to fix everything after a TLS mandate. You may, one day, find out that Google is cutting off Dave's ad revnue simply for this website not mandating TLS.

author: Monkeh
author_rank: Super Contributor
timestamp: April 01, 2017, 04:27:09 pm
content: He doesn't need Google to give him a tutorial on doing his job.Just bloody drop it and stop being a pest.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:28:08 pm
content: Quote from: Monkeh on April 01, 2017, 04:27:09 pmHere is the same to you: Post your login password here, now, if you don't want to use TLS. You don't want to do that, do you? Then try upgrade your browser and move to HTTPS.

author: Monkeh
author_rank: Super Contributor
timestamp: April 01, 2017, 04:29:09 pm
content: Quote from: technix on April 01, 2017, 04:28:08 pmI am using HTTPS. And no, posting your password publically, intentionally making it visible to anyone with no effort on their part, is NOT the same thing. Especially if you're not transmitting it cleartext over wifi.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:33:31 pm
content: Quote from: Monkeh on April 01, 2017, 04:29:09 pmHow many public Wi-Fi hotspots employ any form of security other than a login form? Data over the radio is not encrypted unless something no weaker than WPA2-AES is deployed. (WEP is as broken as plain. A gaming laptop with a GTX 980 can do short work searching the wimpy key space.) If the website itself does not encrypt the data, well your password or session cookie will be sniffed.And that does not include the ISP-level sniffing.

author: Ian.M
author_rank: Super Contributor
timestamp: April 01, 2017, 04:39:35 pm
content: In reply to Technix's reply#40,I am well aware of that and accept the possibility that someone can sniff my session and use it to impersonate me. However those with access have very little to gain by impersonating me or taking over my account and locking me out, and the cost, effort and risks of doing so are relatively high, so its vanishingly unlikely unless I attract the ire of J Random Cracker who's been pissed off by some other Ian.M on the net, and even so, as I don't use WiFi, they would have to be in a position of trust somewhere in the network between my router and the EEVblog server.If I was a public figure or political activist it would be a different matter.I say again: How does my acceptance of an insecure session here compromise *YOUR* security?

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:50:31 pm
content: Quote from: Ian.M on April 01, 2017, 04:39:35 pmYour ISP is there.You will be sold as your ISP's product to ad companies. You probably already have been.Also a money-driven hacker sniffing a password from EEVblog may lead to hacking into your Email account. That can lead to your PayPal account or online banking account. Now kiss your life savings goodbye. All the hacker wants is your money. They may even put you into a debt if your bank allows online loaning. Hope your local law enforcement can solve that...

author: Monkeh
author_rank: Super Contributor
timestamp: April 01, 2017, 04:51:46 pm
content: Quote from: technix on April 01, 2017, 04:50:31 pmUsing TLS on websites does not fix poor password policy.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:55:04 pm
content: Quote from: Monkeh on April 01, 2017, 04:51:46 pmAt least hackers cannot simply sniff it off your connection regardless what your password might be. They need to perform some cryptanalysis for that password. TLS does not enforce a good password policy, but transmitting password in plain ruins any password policy regardless how good is it.So enable TLS and change your password with TLS on. Done, whatever the hacker had is now useless.

author: Monkeh
author_rank: Super Contributor
timestamp: April 01, 2017, 04:55:42 pm
content: TLS is available. Please change your password and STFU.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 05:00:04 pm
content: Quote from: Monkeh on April 01, 2017, 04:55:42 pmI have already done that.Just not seeing the green padlock on every page makes me a bit uncomfortable, especially knowing that this specific forum software puts a login box on any page if you have not been logged in.If that feature can be turned off, at least turn that login anywhere feature off, and use absolutely mandated TLS on the login and password change pages. Session cookies can still be sniffed, but at least passwords are safe.

author: ebclr
author_rank: Super Contributor
timestamp: April 01, 2017, 05:03:40 pm
content: I also changed my passwordWas 12345nowsecret....

author: Unknown
author_rank: Unknown
timestamp: April 01, 2017, 06:42:55 pm
content: Quote from: technix on April 01, 2017, 04:19:25 pmI appreciate good cryptography, well implemented and liberally applied, but this argument is over the top. You might as well say: "Don't have a conversation in your bedroom, because someone might be listening outside with a laser microphone. Otherwise, you might as well take out an ad and post a transcript in the New York Times."There is nothing you say that is technically inaccurate. Yes, unencrypted traffic is trivial to intercept on any broadcast medium. Yes, the Internet is a scary and untrusted place. But to compare someone local going through the effort of extracting an EEVblog forum login over public wifi and then deciding to abuse it, versus posting those credentials in a public forum indexed by search engines, is hyperbolic at best.It also ignores simple things that you, the user, can do to reduce your own risk:Using proper password management, so that credentials aren't useful in more than one placeLogging out to invalidate your session authenticationTunneling your traffic to a more trusted location closer to major transit providers (i.e. using a VPN), if you're on an untrusted networkI understand the incentive to want to push out best-practices TLS to protect unskilled users, but really, in this context? The stakes couldn't be lower. I'm pretty sure there isn't a black market for EEVblog forum logins. That kind of energy would be better directed at the poor security of banks and other more important institutions.

author: PA0PBZ
author_rank: Super Contributor
timestamp: April 01, 2017, 06:59:07 pm
content: Quote from: technix on April 01, 2017, 04:19:25 pmI hereby giveyoupermission to postmypassword here. If it is that simple I guess it will not take you longer than 48 hours?So you have 48 hours, after that the permission is withdrawn.

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 07:02:34 pm
content: Quote from: technix on April 01, 2017, 05:00:04 pmThe lack of the green padlock is due to some smiley icons still using http instead of https. This is a known issue and is in the queue to be fixed. So, there's nothing to worry about. If in doubt, check the stuff on the page as to what is or isn't encrypted.

author: med6753
author_rank: Super Contributor
timestamp: April 01, 2017, 08:10:13 pm
content: I am not an IT or security expert so please excuse my ignorance. But could someone please explain, in simple and direct terms, what the issue is that is causing all this fuss and twisted panties?Am I open to a hack attack if I continue to participate in this forum?Do I need a tinfoil hat? Watch out for black helicopters?

author: ebclr
author_rank: Super Contributor
timestamp: April 01, 2017, 08:56:34 pm
content: Basically is a fool that does not have anything to do, and wanna play finding problems where does not exist

author: rrinker
author_rank: Super Contributor
timestamp: April 01, 2017, 10:29:43 pm
content: Oh no! people know I frequent the EEVBlog!SSL inspection and rewrite is a standard feature of many firewalls and web filters (and yes, it does cause problems). There's really nothing that stops these devices from making other alterations to the packet stream if they really wanted to do bad things. The alternative is to configure such devices to just pass SSL unchecked, and that simply does not fly in many types of businesses. This is nothing new.Maybe if I stayed off of here I'd get more work done on my projects....

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 10:41:34 pm
content: Quote from: med6753 on April 01, 2017, 08:10:13 pmSimply put, the security of the forum is being enhanced and there are some niggles remaining to be worked out. Proceed in the usual fashion.QuoteTurning on a computer that is connected to the Internet makes it potentially vulnerable to hack attacks.QuoteNot unless you needed to before reading the forum today.Nothing more to see here. Enjoy your stay at the EEVblog forum.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: April 01, 2017, 11:34:32 pm
content: Quote from: rrinker on April 01, 2017, 10:29:43 pmThe ISP knows you will have gone regardless of SSL. The meta data is enough for the is to build up a profile. In some counties they no doubt already do.The SSL issue is just a broad brush stroke over finally moving from an unencrypted connection and dumping HTTP completely. Eventually.

author: PointyOintment
author_rank: Frequent Contributor
timestamp: April 01, 2017, 11:49:26 pm
content: Quote from: rrinker on April 01, 2017, 10:29:43 pmThey can only do that if at least one of the following is true:- They have installed their MitM system's certificate on your computer, or tricked you into installing it. (On a corporate computer, this is easy, because they own it and presumably have system imaging and remote admin capabilities.) You can detect that this is happening using certificate fingerprinting, but you can't prevent it without uninstalling the certificate. (In a corporate environment, uninstalling the certificate, or attempting to bypass the MitM proxy after having done so, might trigger some alarms.)- They have stolen the private key of the website you are trying to connect to, and can therefore perfectly impersonate that website. Preventing this is reliant on the server's security—the key could be obtained by e.g. RCE or Heartbleed.- They have control over a CA that your computer already trusts. There are some questionable CAs that come preinstalled on whichever OS—do you really trust them all? (Such as the Hong Kong Post Office?)Quote from: technix on April 01, 2017, 04:50:31 pmHTTPS cannot prevent your ISP knowing which sites you visit. Even with HTTPS, the domain name has to be sent in the clear to the server (i.e. after DNS stuff is done), to enable the server (which might host multiple websites) to know which site you're requesting. Now, I don't know the details of what the US just decided to allow ISPs to do, but if they're allowed to sell to advertisers a database of correlations between customer IP addresses and domain names, or interests, HTTPS will not hinder that. A good (paid) VPN service will prevent that. I got a lifetime subscription to one from MakeUseOf Deals—I see such offers on the various deals sites pretty often. You can look up reviews and comparisons of the various VPN services if you like—the one I got is pretty well reviewed.Quote from: Ian.M and othersPlease explain. I cannot think of a reasonable reason to not be able to use HTTPS. Do you insist on browsing the forum using WebTV or an ancient Palm PDA?

author: Monkeh
author_rank: Super Contributor
timestamp: April 02, 2017, 12:20:53 am
content: Quote from: PointyOintment on April 01, 2017, 11:49:26 pmSome people insist they are completely unable to upgrade to a modern OS and refuse to use one of the several available browsers with their own TLS stacks supporting modern crypto.

author: TerraHertz
author_rank: Super Contributor
timestamp: April 02, 2017, 12:52:52 am
content: Oh, so something about the forum _did_ change on April 1st. It was confusing me, since that morning was when I noticed my preferred browser (Opera 12.15, the last version before it got Chrome-borged) suddenly stopped working with eevblog.That something in the browser error log suggests that _somehow_ Opera auto-updates got turned back on (should be impossible), and it's April Fools day, made me think the change/fault was at my end. But it's too deep for my little net knowledge to figure out what was going wrong. Screenshot of how eevblog suddenly looks like, and the error log. I had no idea.But yes, that Opera version is incapable of handling some forms of encryption. Firefox still works with eevblog, so I guess I'll have to use that instead of Opera from now on.As for https, complete waste of time in my view. If you've been following the wiki and other leaks about CIA hacking utilities, you'd be aware the entire computing ecosystem is totally compromised, from the hardware (CPU backdoors) up through BIOS, all OSs, and the net backbone. There are toolkits for taking over any computer system at any time, via any kind of net connection. Not to mention Microsoft and Intel embedding deliberate State backdoors in their products. The latest vault 7 (part 3? I forget) CIA-tools release (Marble) includes utilities for making hacks look like they came from other entities than the CIA. And apparently the source code for all these tools has been out in the wild for ages.I just give up on attempting security. Run an old OS, on old hardware, old browsers, with nothing interesting on the machine and no auto-updates (so at least it's stable.) Be an unattractive target.Anyway, so you broke compatibility with my favorite browser. Oh well, can't be helped, but at least now I know what happened.

author: ebclr
author_rank: Super Contributor
timestamp: April 02, 2017, 01:41:33 am
content: https://www.zeropc.com/

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 02:12:34 am
content: Quote from: PointyOintment on April 01, 2017, 11:49:26 pmAt least your ISP wouldn't have any idea what you are actually doing here, unless they MitM your connection (which means you have some even bigger problems.) At least your login password and session cookies are invisible.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 02:19:07 am
content: Quote from: bitseeker on April 01, 2017, 07:02:34 pmThat is why I am suggesting HSTS. Supported browsers will see and remember that this website prefers proper TLS, and will silently rewrite any http://*.eevblog.com links to https://*.eevblog.com. You can then set up a reporting mechanism (supported by most modern browsers, Google have a free report collecting service any web masters can use) so whenever a link you forgot to upgrade is encountered the user's browser will report it to the web master.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 02:22:41 am
content: Quote from: PA0PBZ on April 01, 2017, 06:59:07 pmI am not a black hat hacker and stealing passwords is a criminal offense here. So I will not do that. Also this attack requires an attacker physically located near you which I am not.

author: bitseeker
author_rank: Super Contributor
timestamp: April 02, 2017, 02:28:55 am
content: HSTS is unnecessary since TLS is not currently required. TLS may be the default, but you can choose not to use it. It's your choice.Once the remaining anomalies in the forum software are fixed, URLs will be generated properly and everything will work correctly with or without TLS.If TLS was required, then HSTS would ensure that it was used.

author: TerraHertz
author_rank: Super Contributor
timestamp: April 02, 2017, 02:32:33 am
content: Quote from: ebclr on April 02, 2017, 01:41:33 amQuoteHighlighting just one way in which cloud storage is for the birds. That's not the solution to this situation.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 02:45:43 am
content: Quote from: bitseeker on April 02, 2017, 02:28:55 amYou can use HSTS along with serving HTTP pages normally. Supported browsers (which are the newer ones that supports strong crypto in the first place) will default to TLS once they see HSTS header. Older ones not supporting HSTS will blissfully ignore it.

author: Brumby
author_rank: Unknown
timestamp: April 02, 2017, 03:06:21 am
content: This is getting ridiculous.Wearing a seatbelt does not mean you won't die in a car crash, but it does mean you are less likely.Bring on the HTTPSeatbelt

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 03:24:58 am
content: Quote from: Brumby on April 02, 2017, 03:06:21 amThat is the entire point of seatbelts. Without it you are 100% dead in a crash. With the seatbelt you have 30% likelihood to survive. That is enough to result in laws mandating seatbelts in almost all countries.The same applies here. Without mandated TLS your session cookies are 100% leaked. With TLS it is a bit less likely to. Now this plainly warrants mandating TLS on most of the world's websites.

author: Brumby
author_rank: Unknown
timestamp: April 02, 2017, 03:34:14 am
content: Quote from: technix on April 02, 2017, 03:24:58 amThat's taking things to the extreme - and incorrectly, BTW.An invalid argument is the best way to destroy your credibility.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 04:17:37 am
content: Quote from: Brumby on April 02, 2017, 03:34:14 amNow how do you specify what a crash is then? Without a precondition your argument is invalid too.I should have specified my precondition too though. My bad. The crash I was talking about is the standard small vehicle crash test used in China. That test model is chosen specifically to reflect the average crash condition in China (that is, normal Chinese highway speeds, hitting a target with a lot of inertia equivalent to a loaded truck.) and it results in certain death without seat belts.

author: Brumby
author_rank: Unknown
timestamp: April 02, 2017, 06:20:25 am
content: Quote from: technix on April 02, 2017, 04:17:37 amThat is better. You have now defined a situation - one which wasnecessaryfor your conclusion to haveanyvalidity.QuoteMy argument was not invalid. The statement I made did not mandate a single,specificoutcome - yours did.To illustrate:If the 'crash' was at 10km/h into a parked car, then my original statement is still valid. Yours was not.Yours only achieves validity after defining much more extreme crash parameters.Even then, to state 100% fatality is an absolute that is very likely to fail. All you need is ONE person to survive such a crash - no matter how badly injured they may be - and your argument falls down. I know I'm being picky, since the probability of survival is extremely low - but absolutes are things of which I am wary.

author: Brumby
author_rank: Unknown
timestamp: April 02, 2017, 06:23:30 am
content: Anyway ... this is off topic.Lets just leave Gnif to sort out stuff in peace.

author: amspire
author_rank: Super Contributor
timestamp: April 02, 2017, 06:38:07 am
content: Quote from: TerraHertz on April 02, 2017, 12:52:52 amThe Vivaldi web browser (a project continuing the Opera 12 features) works fine with the forum.https://vivaldi.com/

author: PA0PBZ
author_rank: Super Contributor
timestamp: April 02, 2017, 08:32:02 am
content: Quote from: technix on April 02, 2017, 02:22:41 amThank you, you just invalidated your earlier statement.Quote from: technix on April 01, 2017, 04:19:25 pm

author: denverpilot
author_rank: Regular Contributor
timestamp: April 02, 2017, 08:47:12 am
content: All the drama over http/https and TLS lately and the world still doesn't have a proper standard for encryption of DNS.DNSCrypt is out there but a long way from being commonplace or standard.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 09:49:36 am
content: Quote from: PA0PBZ on April 02, 2017, 08:32:02 amNothing is invalidate. I have no interest in your password, nor do I have the resource to physically go near your point of presence. Should anyone wanted to troll you, with enough free time on their hand, they can sniff your password off your connection and begin trolling.

author: SeanB
author_rank: Super Contributor
timestamp: April 02, 2017, 09:59:09 am
content: Yes, the Internet was originally a network to join computers, and worked on the assumption that all were implicitly trustworthy. Nothing can really change that, all is just going to be another layer on top.That is why Telcos still offer ( at a real ruinous price, they hate the 5 nines reliability they have to provide with this which means dedicqated techs in the areas just in case, along with a lot more equipment redundancy over the current IP "best effort" approach) dedicated lines, with data travelling over internal Telco switched packet networks, with guaranteed throughput and multiple path redundancy along with automatic failover to the redundant path on error. We just last year turned that off, and I still have the old packet switches and router in my office to tear down, Not much call these days for a 56k link, but it was secure, and was perfect as an email link from our ISP and a connection that would almost never go down for support to work through.

author: technix
author_rank: Super Contributor
timestamp: April 02, 2017, 10:33:11 am
content: Quote from: denverpilot on April 02, 2017, 08:47:12 amAt least on my home network I set up a local DNS cache server and firewall rules that enforces all DNS requests to DNScrypt gateway on my router. My home network implementation is fairly hardened...