yashsingh1/xdaforums huggingface dataset:
[About XDA developers] benkxda:
True, only full secured websites are really secured. Thanks for this hint, will edit my prior post. :o
[About XDA developers] nikwen:
Of course, it should be added to the entire site. However, I didn't even think about the downloading thing. That's definetly true and I'll add that.

Feel free to spread the word. ;)

Thank you very much. :good:

Posted at the same time. :laugh:
[About XDA developers] Mardon:
Not fully correct.

NSA is getting also access to https secured connections.

http://www.dailytech.com/FBI+NSA+Wa...Keys+from+Internet+Companies/article32046.htm
[About XDA developers] nikwen:
That's right, but our main concern should be the (bad) hackers. It is difficult to stop the NSA, you know. ;)
[About XDA developers] benkxda:
This must be verified first, but frankly I really believe, they try to get those master keys. But they would need a master key to get access. At least, an encryption keeps out most assailants.
[About XDA developers] Mardon:
Right https is much better i agree ;)

If NSA or FBI or who else gets the masterkeys there also exist a chance for others (hackers) to get the keys too.

I think the whole internet needs a new full encrypted security protocol in future where the keys are randomly changed and such things like masterkeys only working a few hours to minimize the hacking risks.

But thats offtopic i think ;)
[About XDA developers] benkxda:
Oh yes, indeed I recently thought almost the same. And maybe we are a bit special picky, hope the "normal" users can keep up that indignation or sometimes outrage on these spy stuff. Also true, off topic.
[About XDA developers] calisro:
you realize there aren't one set of master keys for all certificates right? lol. Each certificate has a master key owned by the company owning the cert. If facebook gives them their master keys that doesn't mean they can snoop your xda or bank account traffic.

ok back on topic! I digress!
[About XDA developers] pulser_g2:
Just saying, but on HTTPS stuff that we use, we use forward-secret HTTPS. Meaning the "private key" for the site is of no use for decrypting past connections. That's becoming more popular for larger sites these days, but I started looking into it a while ago, and it is ready to use now. Look for a key exchange method of DHE or ECDHE :)

As such, the only value in obtaining such keys would be to spoof future connections. If someone is that determined to target YOU individually with spoofed or MITM'd connections, you should be worrying about other things (it would be fairly impractical to mount a widescale meaningful attack).

If you are concerned, you should look into the issues with the CA system who issue SSL keys - an SSL certificate can be signed by ANY of them, and there's a number of CAs who are somewhat sketchy in trust... Tl;dr if an active attacker wants a key for your site to spoof it, he can get it. It won't be the same one (cannot decrypt legit traffic), but can be used to impersonate the site.
[About XDA developers] nikwen:
Thanks for the info. I didn't know that. :)
[About XDA developers] nikufellow:
Not a techie nor from a part of the world affected by PRISM (?) but still having read all this I'm inclined to say i second this motion
[About XDA developers] nikwen:
Great. :)

Are you sure that you are not affected? Everyone is, some more, some less.

(http://upload.wikimedia.org/wikipedia/commons/5/5c/Boundless-heatmap-large-001.jpg)
[About XDA developers] nikwen:
We've reached over 50 votes. :)
[About XDA developers] benkxda:
Nice. So, some people know about HTTPS and encryption and prefer that. Not only because of the secret services of the "Five Eyes", but also to protect me from curious network administrators. There are surely more on XDA, who want to support this necessary petition.

EDIT: Oh, please don't misunderstand, I did not want to protect the secret services from other countries, as they might be not better in privacy protection, for eg the German secret service called "BND" seems to be the sixth eye. Again, I did not want to say only those five do bad things.
[About XDA developers] rog_star:
As lots of users don't know / care about encryption, a secured https connection with XDA might sensibilize at least some.

So, I support your request.
[About XDA developers] nikwen:
Yeah, I hope so. ;)

Thanks for voting. :)
[About XDA developers] Vagelis1608:
I think that XDA Premium should have ad-free browsing and not exclusive https (for 3-5$).

If you end up making XDA Premium, all members who have already donated that amount should get it automatically.

Https should be free for everyone.

I wish it was as easy as pushing a button :/ .

Sent from my D620R [Stock 4.4.2]
[About XDA developers] selemine:
bitpushr, where are the embedded images served from that you mentioned?

Xda cdn or external hosts?

As I said earlier,mixed passive content isn't that bad
[About XDA developers] bitpushr:
People embed images all the time from miscellaneous hosts (imgur, photobucket, etc). Yes, the site will load (in most browsers) with mixed content, it will just show a 'grey' https indicator in the url bar. But some browsers will throw an active warning for that.
[About XDA developers] selemine:
which ones?
[About XDA developers] SecUpwN:
What exactly would you and the other Admins convince to completely make XDA ad-free and parse all data through HTTPS? Would it be a certain amount of donations (either money or hardware)? Maybe if we started talking what exactly it is that prevents this, we'll find a solution?

Thank you for your effort, I very much appreciate that. It is at least a start. Could you enable such system at LEAST also for PM's, please?

I vote AGAINST such a two-class XDA experience. I don't think it's a great idea to only provide security to the people who paid money. We should provide BASIC security features for everyone and then go from there. Having a secured login is a start, and I also think that everyone deserves secured private messaging. My suggestion is to further erase ads for the people who donated a certain amount and then also enable HTTPS everywhere else for people who donated another certain amount.. you see where this is going. What do you think about this proposal, [MENTION=450224]bitpushr[/MENTION]?
[About XDA developers] bitpushr:
Thank you for your feedback, we'll be going over this to see which direction we'd like to take.
[About XDA developers] selemine:
how about this:

you stop the redirect from https to plain and switch the requests for site objects to a protocol agnostic format and let us see how bad the experience with mixed content is ?
[About XDA developers] SecUpwN:
How about this, [MENTION=450224]bitpushr[/MENTION] and [MENTION=335322]MikeChannon[/MENTION]: Put the (relevant) source code of XDA on your GitHub and let people contribute to HTTPS integration?
[About XDA developers] TheLastSidekick:
You know, before reading this thread I never thought about how scary this was. Now, I'm a bit freaked out. But part of being secure, is being paranoid and aware, right?

And might it be a good idea to FORCE https on EVERYONE, but I don't know if that is feasible, or just something that sounds good on paper and wouldn't really work.
[About XDA developers] SecUpwN:
In my eyes, HTTPS has just not been enabled due to the potential "loss" of ad revenue. All other "reasons" are pure BS.
[About XDA developers] Vagelis1608:
XDA needs dedicated machines to get HTTPS because the current servers can't handle the load of SSL from such a big site.

Sent from my D620R [Stock 4.4.2]
[About XDA developers] ThomasVanhoutte:
If they use SPDY, they should hardly notice performance issues.
[About XDA developers] E:V:A:
That is not a very pro-active statement is it? If you think that is the problem, I think you should hire some new professionals to setup your servers. I've run very popular servers running HTTPS many years ago on celeron machines. Maybe if XDA got rid of some of their ad/flash bloated front pages that are reloaded every time you pick your nose, perhaps you'd save some bandwidth. I bet a dollar that nobody have actually bothered to do (and present?) any kind of performance test on this site.

In addition, another thread to start would be "We want account access logs on XDA!". Why XDA doesn't tell you from what IP you last login came from, is far and way beyond me, and just confirm XDA's utter lack of interest to provide any form of sensible security.
[About XDA developers] benkxda:
Showing the last recent log ins with date, time, IP address, maybe user agent... that's a great idea. I would be ok with a limited logfile.

BTW it's good that we have [MENTION=4372730]E:V:A[/MENTION] fighting for more security. As I saw, he's very well experienced in security.

[MENTION=5101348]nikwen[/MENTION] maybe we rename the thread in something like "We want more security on XDA" or something like that in order to collect suggestions like log in log files or whatever will improve security on XDA?
[About XDA developers] WGibzz:
BTW, logrotate can be configured too.

For example, 1 day of acess, error, etc entries writes in log file, then this logfile gzips and pushes on dropbox, or other cloud.
[About XDA developers] pulser_g2:
Well, I can tell you that XDA uses a large number of dedicated servers. It also uses CDNs to try to speed up page loads for users around the world.

Regarding "account access logs", doesn't that raise a number of questions? For example, if such logs were available in an account, it would mean that data would have to be retained etc, and stored against each user.

Some may feel that was a violation of their privacy. It also means anyone with access to your account (through any means) could likely view such information. While it sounds an obviously sensible idea, there's privacy concerns, the more information you make available per-account.

(before someone asks, the reason why I say it like that is that, most likely, you would need to log multiple IPs, since otherwise an attacker could "mask" previous connections. Also, many of the "apps" that people use to browse the site do regular logins from their mobile device, which would be on their own network, or on their mobile data network, thus hiding the trail of the last login).
[About XDA developers] pulser_g2:
Not sure I get the idea here - why would you want your gzipped XDA access logs pushed to dropbox or similar? That's a privacy disaster waiting to happen when Dropbox next forget to actually check user passwords... And that's ignoring the fact Dropbox can just view your (client-side unencrypted) data anyway.
[About XDA developers] pulser_g2:
The issue is that you gain no real security by enabling HTTPS for PMs.

1. Do you use email PM notifications? Your email provider just got them in plaintext, as they were transmitted over the internet, in plaintext, through the core routers and switches.

2. If you enable HTTPS for just PMs, someone would compromise your session cookie from a non-HTTPS page, and access your PMs.

I'm a massive pusher for security. I work in the field, and I want to see it happen. The thing is, I don't think "pseudo-security" is good for anyone. For example having HTTPS on only PMs - it would be a false sense of security right now, and it would thus be deceptive. And the last think I think anyone wants is to be falsely reassured by something like that. That's why I don't imagine doing HTTPS just for PM would be an option.
[About XDA developers] pulser_g2:
XDA don't own the rights to share vBulletin's source code publicly. It's plain source, and can be modified, but the rights to share it are not owned by XDA.
[About XDA developers] Jonny:
Now come on, how many forums, running vBulletin or otherwise (and not managed by you) have this "feature" active? I'm signed up and active in a fair number of forums and I can tell you, none of them have this so called "feature" so I think you're being a tad unreasonable here, especially with the last couple of comments...

Also, what pulser said.
[About XDA developers] benkxda:
It's not a bug, so I see a real feature. Otherwise, I hope we won't compare XDA with other forums, I want to see us ahead.

What [MENTION=2178960]pulser_g2[/MENTION] said is probably right. I assume he is one of the most experienced members at XDA and no one knows the server infrastructure and its potential better than him. There are some problems to be solved before we claim the next step, ok. But as mentioned somewhere in one of the last pages, there was not much progress over several months or at least we cannot see any changes.

Please be aware that my English is not that grand that I can express myself absolutely clearly. No offense intended, I just want to see a vivid discussion and finally progress.
[About XDA developers] WGibzz:
As I said - for example. =)
[About XDA developers] SecUpwN:
Ok, I've had enough of this "maybe we get something one day" talk. I'm throwing up about this not being solved! What can WE do to ENFORCE those security measurements to be implemented, [MENTION=2178960]pulser_g2[/MENTION]? Collecting donations? Tell us and we'll do it!
[About XDA developers] ace312:
Yeah! It will be very useful!
[About XDA developers] MZ4Mobile:
it's a must

for a big comnity like XDA it's a must to be secured
[About XDA developers] mamece2:
so... the two options are YES? :eek:
[About XDA developers] :
Wait, you're right! That's weird...

I guess that makes it so that everyone always votes yes, because if you want to vote no, you either have to vote yes or you have to not vote at all.

This is a major fallacy! :mad:
[About XDA developers] Vagelis1608:
Why wouldn't anyone want extra security?

Sent from my GT-I5500 [CM11]
[About XDA developers] :
Well, I truly don't know, but that's beside my point.

My point was, why include a poll if you're only going to give the voters a positive option to vote for?

A poll (in this case) is supposed to be a comparison between who is for something and who isn't, not just one big volume of people who are for that subject.

Do you see what I mean?
[About XDA developers] nikwen:
When creating this petition, we had to make sure that only XDA members would be able to vote and that everyone could vote just once, so we decided to use the forum's poll feature. However, it does not allow polls with only one option so we added another, somewhat stronger "yes" option. We felt we did not need an option for those who find this feature superfluous.

Sent from my awesome Ubuntu Touch device using the Forum Browser app
[About XDA developers] :
Oh, that's right!

It makes sense now, thanks for the post.
[About XDA developers] gee one:
To be fair, someone could make a "We DONT want https on XDA" poll.

Then to cover all the bases, we would just need a "I'm ambivalent about https on XDA" poll, although sometimes I wonder if all the apathetic people really vote or not.

;)
[About XDA developers] pulser_g2:
Just a FYI that the new XDA:one app (in the About XDA forum as a sticky) now communicates with the XDA API over HTTPS. The app itself is also open source.
[About XDA developers] nikwen:
That's actually great news. Thanks a lot. :good:
[About XDA developers] mesquka:
I Tried packet sniffing my own password on my LAN. I'm not logging in to XDA on a public wifi network until this is fixed. I'm not even sure I want to login AT ALL, but I <3 XDA.
[About XDA developers] benkxda:
Any news about HTTPS or any other key security features? Just being interested.
[About XDA developers] SecUpwN:
No. It will likely never happen. But hey, we have a NEW site design! Whoohoo! Enjoy!

/sarcasm off
[About XDA developers] benkxda:
Well, after two years, I think bringing up a new design is ok. A few more tweaks and it's usable.

The new XDA app uses HTTPS, so this is a good step. And if the app can communicate via HTTPS, then the third party content might be no problem anymore. Maybe the ad framework is a problem... idk.

Yesterday I experienced a really slow XDA forum with around 58,000 users online. If the amount of users was the problem for this slow reacting XDA forum, then HTTPS might be a bad idea atm. Hopefully we can get some more servers from Leaseweb to drastically speed it up.
[About XDA developers] xuhdev:
Any news on this topic? I still see no https. Even many super small sites have started to use https nowadays, cannot believe such a high traffic forum does not offer this feature!
[About XDA developers] Vagelis1608:
The high traffic is the reason why https isn't available yet.

It's hard and it costs a lot.

Sent from my D620r [Stock 4.4.2]
[About XDA developers] jez9999:
It might use a bit more CPU, but I'll take issue with the word "hard". It's easy to turn HTTPS on. I've done it for my small websites, just for the hell of it.
[About XDA developers] Vagelis1608:
Since you don't believe me, here is the official statement from bitpushr:

Sent from my D620r [Stock 4.4.2]
[About XDA developers] l2d4y3:
Not only HTTPS, but also IPv6 is what I am expecting.
[About XDA developers] gab90c:
for real? not even in the banks are so worry about security lol
[About XDA developers] SecUpwN:
An Android forum, where security Issues of Android are discussed and apps are being developed every single day should provide the lowest security measure, which is HTTPS.

If you ask me, the admins of this site DO NOT WANT a secure connection to their forum (would be interesting to find out who exactly those guys are running this site and what their political motives preventing HTTPS might be). Telling us that it is "too difficult" to implement is pure BS. No rant, just my humble opinion.
[About XDA developers] BlueStar88:
We have March 2016 now, 2.5 years past the start of the vote. Still no HTTPS. It's not understandable, really.

I've seen this in different hardware "hacking" projects. Those people responsible just focus on their nifty little things they're up to, but nothing more. On one hand they strive for improving things (yes, even security!), but are facepalmingly failing in their ways to communicate information and data to each other.

I'd like to understand having customized ROMs, tools and such, given by reputable people, as a very important security measure against the industry, who is leaving us alone in the regard of having true or at least some independence from them. But all this doesn't help, if the stuff is served through weak websites and very questionable download services using no transport encryption nor any hashing methods to support prove for data integrity. It's the same bad behaviour still many hardware vendors serve BIOS updates and drivers.

Guys, the threats in the world are real. Time to give up the reckless "just playing" (well, hacking) attitude of the late 90s... we have an information warfare going on at present and things get worse, not better.

There are no options left. I can't go elsewhere to fight for my devices independence except using sites like xdadev, so you have to improve this for the bigger goal.

It does not need to have to vote for, it is a basic requirement for serious operation.

BTW: There are no load issues using HTTPS with AES ciphers with modern server hardware (see "AES-NI"), so this point is invalid forever.

Examples:

LG Root package, referenced here [1], is served here [2]. The host seems to sit in Tampa, Florida. Each time I download from there the traffic goes through GCHQ, ready for malware injections.

LG Drivers package, referenced here [1], is served here [3]. The hosts uses HTTPS, but all the downloads on that page are served without transport security off from

Spring, Texas. Again, for me along the route where GCHQ sits.

LGUP, referenced here [4], is served by ugly places with no transport security (except the Dropbox-link, but this one is dead anyways).

This list could go on with the same result...

If I were GCHQ or NSA, I would anchor my injection loads to sites like xdadevelopers, to catch all those "shady" (?) guys trying to go their independent way, so they are the very opposite at the end.

[1] http://xdaforums.com/android/development/guide-root-method-lg-devices-t3049772

[2] http://d-h.st/uO8h

[3] https://androidmtk.com/download-lg-usb-drivers

[4] http://xdaforums.com/g4/help/lgup-install-kdz-mm-lp-t3249803

From a security point of view, this is a catastrophy. This might be okay for playing kids, but that's it.

No offence, I'm just disappointed. On one hand very cool guys doing the their best work to overcome hardware vendors pitfalls, cracking those nuts until the nights, striving for independence, but on the other hand potentially unreliable results for themselves (their team mates) and their random users (like me).

Kind Regards

BlueStar88
[About XDA developers] Mardon:
More important for xda is to fix this and inform xda users about security break on xda.

I was speechless after reading it.

http://seclists.org/fulldisclosure/2016/Mar/37

Gesendet von meinem LT18i mit Tapatalk
[About XDA developers] benkxda:
Wow, not bad :rolleyes: ...got a bad feeling about that.

As [MENTION=5493829]BlueStar88[/MENTION] already said, 2.5 years ago (2.75 to be exact) this thread started, less attempting to be a real poll, but to set a statement. Some of us want to get more security all over XDA. As this is the most important forum for open minded mobile device users, it's of course a great place for secret agencies from all over the world to start with their software manipulation. But even other authorities and other criminals are interested to inject some ****e into the code - whether in ROMs, kernels, mods, apps or even in the website code, server side and/or client side.

XDA Developers has to pay bills, of course and they grew from enthusiasts up to a company, with the goal not only to be able to pay the bills, but also to maximize profit. We can understand that, but they have to understand our needs as well.

Several users found this thread and some absolutely say the pure truth - without cuddling. Thanks to [MENTION=4686037]SecUpwN[/MENTION] for always crystal clear words. We want to have at least the most famous standards for increasing security and reliability within this forum. The standards must be implemented rock solid and I think [MENTION=2178960]pulser_g2[/MENTION] absolutely is the right person to do so. Nevertheless, we somehow expect more focus on security.

Beside HTTPS, which is still not present even after this long time and even if it became standard for a lot of other web sites, XDA Developers would surely the right thing to focus more on overall security. If the story is fully true and XDA did not respond to the finder of the security flaw, it's a shame. This behavior is what I know from other business sites for over a decade - their providers also tried to focus on maximizing profit, not security.
[About XDA developers] nikwen:
Thumbs up on that and thanks to [MENTION=868594]Mardon[/MENTION] for the link! I was speechless as well …

[MENTION=2178960]pulser_g2[/MENTION]
[About XDA developers] SecUpwN:
[MENTION=5101348]nikwen[/MENTION], just to let you know: I pushed our request again in the thread [OFFICIAL XDA][BETA][MAR 28]XDA Labs: Forum App + App Installer + Xposed Repo.
[About XDA developers] hackslash:
Why don't use Let's Encrypt? It offers a free SSL certificate (if you're running your website on a web server) and the CA is completely open source. Every certificate issued by them has a 2 month expiry limit but you can always renew them with a simple terminal command.

The Let's Encrypt project is funded by Linux Foundation and is sponsored by Mozilla, Chrome, HP Enterprise, Site Ground, Vultr , etc. So it's pretty safe to trust their certificates.

Here is the link to their official website: https://letsencrypt.org/

And here is my repository server on which I have installed a SSL certificate from Let's Encrypt: https://dev.pctecha.com
[About XDA developers] selemine:
The problem usually is third party content and rewriting thr website to support protocol agnostic links. Enabling TLS is easy, but making sure there are no mixed content issues takes effort.
[About XDA developers] :
Damned! This topic is from 2013 and its going to the year zero, Why gosh damned there is no httpS for a big popular site as xda!?!?

HttpS IS FREE!!!! Where you waiting for?!? Damned i hate webmasters as xda. So sad...