yashsingh1/xdaforums huggingface dataset:
[About XDA developers] ironman38102:
Signed for good. I dont want hackers trying to hack my account after all those posts I made or read my pms. Hope XDA makes this happen

Its Going To Be LEGEND--wait for it--DARY!- Barney Stinson(How I Met Your Mother)
[About XDA developers] bitpushr:
Good news all, we have gotten our CDN provider to add SSL. That means that I can finally add this to the forums. I'm going to have to make some changes to the codebase to implement, and I'm in the process of some other big projects, but this means it can finally happen. :good:
[About XDA developers] doctor_droid:
That's great news :) :cool:
[About XDA developers] benkxda:
Very good, thank you very much for your effort. For me this is one step for a more secure XDA system and as I really love XDA, I love this step we now can take. :D

Can you say how long it approximately will take to see HTTPS on XDA? Don't wanna make you hurry, just want to know, will it take 5 days, 4 weeks or 3 months. Also, I am curious about "some other big projects". Maybe you wanna share some informations? ;)
[About XDA developers] psytr0nic:
seem careless , or usless !notyetHttps
[About XDA developers] nikwen:
Thanks for the signature. :)
[About XDA developers] nikwen:
Wow, cool. :)

Thanks a lot. :good:
[About XDA developers] nikwen:
Thanks for the vote as well as for the signature. :)
[About XDA developers] psytr0nic:
I signed , I voted . C'est noble combat non .
[About XDA developers] :
Vote for a secure XDA: [Petition][Poll] We want Https on XDA!
[About XDA developers] niredec:
Good news!. I like it, i would kill for https. But you have a lot of work for got it.

Never say die! I will wait for news...
[About XDA developers] shinva:
Yes! Nice idea !

Inviato dal mio SM-N9005 utilizzando Tapatalk
[About XDA developers] Microman1934:
here is a website where you can get free ssl certificates:

http://www.startssl.com/
[About XDA developers] BrooklynNY:
I want it too. Nothing else has to be added to the already explained. Thanks for this thread.
[About XDA developers] nikwen:
Have you seen this?

(Link to the post)

Really frightening. :(

So the subject of the thread is more important than ever now.
[About XDA developers] billyJAM:
You have my vote :good:
[About XDA developers] south956:
I vote yes also, we need security on files and password. Aren't we another "social network", then we need privacy too.

For your own custom Sig : http://xdaforums.com/showthread.php?t=1922304
[About XDA developers] nikwen:
Thanks. :)

(Damn thanks button has to recharge...)
[About XDA developers] benkxda:
So true. I also mentioned more account and profile hacks on other community websites. HTTPS doesn't secure your bad passwords, but it's one step in the right direction. And after this, we could take another step. As you know, there are strange things (username) around XDA Developers we currently don't understand.
[About XDA developers] nikwen:
Haha, true. :laugh:

But it's not only you. For example, there's also a Wayland_Ace2 (Wayland_ACE was one of the best developers for our Samsung Galaxy Ace which we've ever had).
[About XDA developers] psytr0nic:
#MacRumors forum hacked; more than 860,000 accounts compromised

http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone

maybe our will follow soon , is this single #S can avoid us that ?
[About XDA developers] nikwen:
Oh, scary. :(

I don't know whether it will help us not to get hacked. It will help us keep our passwords and therefore PMs secret.

However, as far as I know they logged in as a mod and did the hacking from that account (read that they did it like with the Ubuntu forums). So that would be more secure but it would not take all risks away. ;)
[About XDA developers] benkxda:
Yeah... another hack. This time it's a vBulletin hack. Read this.

Oh and don't look into XDA's forum website source - you would probably be surprised when finding something similar to vBulletin. ;)
[About XDA developers] nikwen:
Hm, just wanted to post a similar message. ;)
[About XDA developers] SpiderTilt:
I hope if NSA ever hacks into XDA, they will find our links and download all of our apps and secretly increase our stats on Google Play. Who knows, maybe all of their employees get addicted to our quality android games and give us five starts :)

Anyways, https is mandatory for any site that has a login form.
[About XDA developers] nikwen:
Haha. :laugh:
[About XDA developers] rog_star:
I haven't visited this thread for some weeks, but I am glad to see the votes reaching for 800 :D

Now I am waiting for bitpushr to implement https :good:

Great news.
[About XDA developers] Edge-Case:
Wow, I always out of habit type https:// prefixing everything with it.

So I kinda jus took it for granted and thought it was https://

I am kind of shocked that it is lacking...

One app to prove its just wrong NOT to have https://, anywhere

D-Sploit

Use the cookie sniffer and bam, you can hijack login sessions. Though it doesn't work with https protocol BIG DIRP :silly:
[About XDA developers] maej72:
personally i dont care about it, but i think it will be so helpful for the devs accounts. you have my vote sir :good:
[About XDA developers] nikwen:
Big thanks to both of you. :good:

(Limited to 8 thanks a day... You'll get them later. ;))
[About XDA developers] Westnile:
I agree that security hijacking apps/files/md5 sums is a major issue and can lead to disasterous results that can cripple a community thats as awesome as this one.

I am all for security measures to ensure and try to protect users and devs alike as much as possible.
[About XDA developers] thoiloidainhan:
As a normal user, I dont really care for this feature. However, security is always better than none so the Admins might as well get on with this if they have nothing major planned for the forum. U have my vote sir
[About XDA developers] nikwen:
Big thanks to both of you. :)
[About XDA developers] benkxda:
Thanks guys for your support. I am sure we'll get more security sooner or later, but this is not a point or date of getting security, it's an ongoing procedure. We have certainly a very good educated and trained administration on XDA. That's why I believe they take this challenge and they will find a good solution to protect our privacy and integrity of our provided content.
[About XDA developers] CamoGeko:
I'm supporting this. Can't hurt really to have https.

Should be fairly simple to implement too, its just really depends if the big guns are up to it.
[About XDA developers] p1000haha:
i think https is more security
[About XDA developers] dstruct2k:
No, they can't. vBulletin (the forum software used here and on thousands of other websites) uses Javascript to hash your password before the login form is ever submitted. The only thing that could be intercepted would be a salted+hashed password, so your actual password is 100% secure even without SSL/HTTPS. Just throwing that out there. ;)

Source: I used to write plugins and modifications for vBulletin.
[About XDA developers] sterpas:
It's always better to be more secure... But wouldn't kill for that feature...
[About XDA developers] nikwen:
Thank you though. :)

We reached 800 votes btw. :)
[About XDA developers] |>/\nte:
I totally agree. Https is more secure, but it's not absolutely necessary...
[About XDA developers] jikashow:
Http is a must have for any website today.
[About XDA developers] nikosst:
https is better as it's more secure, but... i wouldnt kill for that :P
[About XDA developers] drmosh:
While SSL for a website is a good idea, it's not necessarily a good idea for forums... this is because of the number of external links and embedded objects which aren't SSL...

So in reality... SSL for a forum is meh... half baked idea...
[About XDA developers] ThomasVanhoutte:
We're talking about the login/register pages, and eventually the private messages part of the forum.
[About XDA developers] refinition:
If implementing in the login pages, I guess i'll support this. But as mentioned before, assets are stored outside the forum which might cause problems..
[About XDA developers] Absolon:
Security is nice if it holds all the way down.

Since this is a pretty large place I guess they would have to invest in some hardware just to handle the SSL-parts

(Ciso has some really nice expensive solutions). But then? Routers? IPSec? Shared computer halls?

Servers run on crypted disks? Crypted database that handles the board? User-accounts? etc.

As others said. It doesn't add that much value if the code if leaking and you can access parts by classic injection for instance.

I vote to move the servers to Sweden! :D

Nice hosting here!

One is PRQ. They a bit under reconstruction since they are the ones hosting "The Pirate Bay" but they still exist and thrive.

They are quite nice when it comes to their philosophy of internet freedom.

Some sites are very controversial (Flashback) but they also don't believe in censorship and are at least consistent and not afraid.

They are hosted themselves by the real hero, Bahnhof & Mr Schwatz (a really nice guy!).

He is the one hosting Wikileaks now after PRQ had to stop because of that the owners got slammed by TPB-case.

(Strange one, One of the judges was sitting in the Anti-piracy lobby. Think there was "some country" involved that put a bit of pressure...)

Funny that "The Pirate Bay" shared the same server hall as the "Anti-Piracy agency" :laugh:

Have to show their hall, it's an old "anti-nuclear shelter": Server hall :good:

Flashback is more local Swedish but they has an English part and is considered one of the "biggest" underground sites with everything from

"Today in media" to "Internet Hacking" to "Urban exploring" to "Trip reports" of different chemical substances. ;)

They had a really nice UE from Tjernobyl, Not those who jumps as soon as their Gigermeter is in pare with their pulse but there you get to a

steady tone from it more or less.

But https won't hurt. You have my vote. At least pm's will not be in total clear text!

But it would be more comforting to know that there is security all the way down...

There isn't any strange law in US that you are required to share certain parts? I know that they forced people to open Truecrypt partitions at the

borders but that got overruled by the "John Doe" and 5th amendment or something. Not very good as US law (Judge Judy is a killer though) ;)

/Abs
[About XDA developers] benkxda:
Thanks for this contribution. I am not sure, what about bahnhof.se due to my heavy lacks in in Swedish, but the other one is working fine to me. Thanks for this, it's always interesting for me to get infos like this.

Oh and special thanks for your signature rant. It's very straight, but I wouldn't say it's far from the naked truth. No security updates leads to an unsecure device. Samsung is doing a great job in showing, how they love their customers.

I love my old Galaxy Nexus, but I won't call it a Samsung device anymore, because it would ruin the real magic of the device. I call it Google Galaxy Nexus.
[About XDA developers] caspboy:
:good: Would come in useful!
[About XDA developers] nikwen:
Just logged in and guess what I saw. :eek:

Thanks XDA. :):):):):)

[MENTION=2178960]pulser_g2[/MENTION] and [MENTION=2235607]svetius[/MENTION]: Is that the default login now? :)
[About XDA developers] benkxda:
Login data is posted to https://xdaforums.com/login.php?do=login, but afterwards it's gone? I am still on HTTP after login... bit confused, maybe not implemented over the whole site.
[About XDA developers] nikwen:
Well, once for some reason (probably a bug) https stayed for me after logging in. You can manually change the protocol by changing http to https in the location bar of your browser, but by default Firefox blocks a lot of images because they are "unsafe". That's probably because something related to images hasn't been transfered to https yet. And as soon as you click a link it's http again.

In my view, https for the login is a great beginning though. Let's hope that they will implement it all over the site. :)
[About XDA developers] bitpushr:
Yup, I changed the login over to https on Thursday evening ;)

I'm not sure that I'll be able to have the whole site loaded over https. As [MENTION=5101348]nikwen[/MENTION] mentioned, any unsecure assets on the page won't load, or will cause an error in the browser bar. And there were issues I could see when I was testing it. But I figured the login form was a start at least.

Likely I will force non-login pages to go back to http until I can come up with a better solution. Since we have so much user generated content with links off-site, I'm not sure we'll be able to offer that without proxying the data and using ssl on our side, which isn't exactly a great solution either.

Once we have it figured out, we'll let you know!
[About XDA developers] benkxda:
Right that. I added the "https://" and it works, ok, with warnings, but, hey, next step. Login via https and still Javascript encryption works, https works as well (if requested).

Thanks [MENTION=450224]bitpushr[/MENTION]. It is so good to see this step. Very good.
[About XDA developers] nikwen:
Great. Thank you very much. :)
[About XDA developers] ThomasVanhoutte:
Thanks, great you guys listen to our feedback.
[About XDA developers] benkxda:
Hey lovers of a safe XDA,

to take advantage of our new encryption possibilities, I suggest we should spread HTTPS all over XDA as good as possible. As I figured out, the most content works pretty good. Only external content including YouTube videos are not working immediately. You have to enable them by clicking on the shield icon in the location bar and then click on "Load unsafe script" (Google Chrome). Other browsers may behave similar.

We can start with changing the links in the signature and add this little "s" to the protocol (-> https://). If we use shortener like goo.gl or the very short v.ht, we shorten those links again, this time with HTTPS.

After changing our signature, we can try to open every single XDA website with HTTPS. This results in having always HTTPS websites and if you share a XDA website, you share the encrypted variant. This spreads XDA over HTTPS :).

Also, we can use XDA internal links within our posts. Especially if we have a lot of links in several posts - like indexes or repositories :D

And again and in short:

Use HTTPS links in your signature.

Open every XDA Developers page in your browser with HTTPS.

Use HTTPS links in all of your posts.
[About XDA developers] bitpushr:
I'm hoping someday this will be reality :)

Unfortunately I've had to turn off http even for login as it was causing some issues on people's browsers and holding the session. I'm continuing to work on getting it implemented permanently.

I'm not sure what the prospects are for turning it on site-wide. There are too many non-ssl content urls (from users who link to imgur or whoever) to have a "green" bar at the top.
[About XDA developers] benkxda:
Nooooooooooooooooooooooooooooooooooooo! Me goes mad :silly::mad::victory:

I already changed signature, the indexes of Fairphone 1, Chromecast, App Tester, App Translator... and a lot of other links...

[MENTION=450224]bitpushr[/MENTION] Do you hate me? (Please say no and furthermore say that you were just kidding, please :angel:)

Well, looks like I am going to deleting some "s" tonight... :eek::crying:

EDIT:

HTTPS is working again in here... [MENTION=450224]bitpushr[/MENTION] please update. Is it now available or shell I get back to HTTP links in signature & threads?
[About XDA developers] Melamunna:
It got quiet in here!
[About XDA developers] benkxda:
Right, sir. But HTTPS is working atm, so I think at the moment:

SUCCESS

:victory:

Check out this page 15 of this thread with HTTPS: https://xdaforums.com/showthread.php?t=2383868&page=15

I won't complain about HTTPS at the moment :laugh:
[About XDA developers] ThomasVanhoutte:
Now let's push 2-step verification? ;)
[About XDA developers] NocturnalDroid:
https not working. Unless it's secured it means nothing, the certificate needs to be a proper one. They cost a lot but XDA is a HUGE organization and I'm sure to keep a professional image in an ever increasingly-hostile internet environment (especially, this area of the web) you'd want to have a secure connection.

EDIT: The certificate itself is actually looking OK, it's just external resources on the connection breaching the security. I'm not getting a secure connection anywhere on XDA using HTTPS.
[About XDA developers] benkxda:
[INDEX] Google Nexus 5 - ROMs, Kernels, MODs, Recoveries, Themes ...HTTPS working for you there? :)

I know, the external content is a problem, but the XDA gurus will find a solution. Therefore I am sure :cool:
[About XDA developers] nikwen:
It's not working for me. I am redirected to the normal HTTP site. :(

Let's hope. :)
[About XDA developers] benkxda:
Hey, nikwen you must have been on the moon or so... long time no see, nice to have you back.

Well, it was working, but currently all https requests (at least GET) are forwarded to http now. But again, it worked and hopefully it will work again, soon.
[About XDA developers] nikwen:
Yes, you're right. I've been away from XDA for some time so I didn't follow this. You've got a PM from me by the way. ;)

OK, so let's wait and hope that it will work again. :D
[About XDA developers] nikwen:
Wow. Very impressive and well-done post. Respect!

I would be glad if more people thought like that. ;)
[About XDA developers] nikwen:
Wow. 1000 supporters. :eek:
[About XDA developers] Bhargav97:
Noup...

Supporters are still 780 and now 781 including me.

What do you think how much we need so that admins think it considerable?
[About XDA developers] Vagelis1608:
The 2 poll options are basically "Yes" "Yes", not "Yes" "No"
[About XDA developers] nikwen:
Exactly, there was no need for a "No" option.

"I'd kill for that feature!" actually means you would do almost anything to get https. (Not to be taken literally though. :D)

[MENTION=4849551]Vagelis1608[/MENTION]: Btw, thanks for the signature link. :good:
[About XDA developers] benkxda:
The secret agents are watching. And they are angry :mad:. And they will write you e-mails, how angry they are. Unfortunately, other secret agencies removed these mails for further investigation, so you won't be bothered anyways :p

But now back to HTTPS: For a short period of time it actually worked. Then the HTTPS was removed, but we encrypt login data with Javascript and we use forward secrecy afaik. The big issue I think was the third party content, like avatar images, linked in videos or images/screenshots/pictures. This breaks the encryption of the website. Someday... until then: "We want HTTPS on XDA!" :highfive:
[About XDA developers] gee one:
Now you tell me! I plead the 5th!
[About XDA developers] selemine:
you could rewrite urls on xda to https in the past and on a few thirdparty sites (i am using https-everywhere with custom rules for that)

but unless xda adjusts their page you got hit by the firefox bug (https://bugzilla.mozilla.org/show_bug.cgi?id=418354) that broke the design, even if the css js and other design parts where available over TLS secured servers.

Forum was working fine, just the front page with the news looked horrible.

Having mixed content might not be the safest option, but it would be big step up , compared to no encryption at all.
[About XDA developers] nikwen:
Anyone noticed that bitpushr voted on the poll? :cool:
[About XDA developers] benkxda:
The attempt of being secure brings new risks as you might have seen: Heartbleed: What XDA Did to Patch This Critical Internet Flaw

It's a bit paradox, you want to get more security and you get much less. Nevertheless we should still try to get more secure connections, outside and inside of XDA.
[About XDA developers] benkxda:
Check the voters, there are so many well known people from XDA. Thanks to all of you!

But on the other side, XDA has almost 5,7 million members even now are about 55,000 members online. This means we have a lot more to do, to keep in mind, that security is not a single function or a point you reach. It's ongoing and we need to stay on track.

To spread our intention a little bit, consider to include a proper message in your signature, here's a template:

We want HTTPS on XDA!

[B][URL="https://xdaforums.com/showthread.php?t=2383868"][COLOR="Red"]We want HTTPS on XDA![/COLOR][/URL][/B]
[About XDA developers] yueyejinghun:
With the viruses and hackers become more and more aggressive. I think HTTPS is a very important way to keep everyone's data safe. voted.
[About XDA developers] sarry86:
Edited my signature too, i fully support this....
[About XDA developers] wangxp:
Must be awesome !

:good: HTTPS ,we are not in mainland of china

freedom https
[About XDA developers] selemine:
DNSSec & DANE should be used as well
[About XDA developers] selemine:
I saw last night that pictures from the cdn servers can be loaded over tls just fine, why are https requests for forum.and the main page rewritten to http then?

what needs to be done?
[About XDA developers] SecUpwN:
Hey [MENTION=5101348]nikwen[/MENTION], great thread! Forum Mod [MENTION=4775688]GermainZ[/MENTION] mentioned your thread here, but I still don't get what is "in the works". Is this really being worked on, or is this just a Poll to make Mods and Admins aware of it? If so, what's the point of further discussing this here since almost 1 whole year?

There is no question we need HTTPS, it's a MUST-HAVE. So please tell me the current status. Thanks.
[About XDA developers] nikwen:
It started as an attempt to make the admins aware of the problem. At some point they told us they were working on it but as you can see, HTTPS is not implemented yet. I'm not sure about the login but HTTPS was used for it some time ago.
[About XDA developers] SecUpwN:
Where did they say they're working on it? Is there an official statement about this somewhere?

Maybe [MENTION=335322]MikeChannon[/MENTION] can elaborate a bit on the current state of implementation of HTTPS on XDA? :cowboy:
[About XDA developers] MikeChannon:
Sorry, don't really have an update on this:

http://xdaforums.com/showpost.php?p=44381296&postcount=28

Mike
[About XDA developers] SecUpwN:
Thanks for answering, Mike. I'm sure [MENTION=4372730]E:V:A[/MENTION] is interested in reading the statement of [MENTION=450224]bitpushr[/MENTION] from August 2013. I get the point that this seems to be a MASSIVE amount of work, which seems to have taken up the time of more than a year. The only two questions I have are: What has been done since the post you linked and what is still keeping XDA from providing HTTPS? I'm sure everyone has alot on his plate, but it feels strange that no further updates have been released in the times of Snowden and N$A. Since I am part of this community, is there something I can do to push progress?
[About XDA developers] E:V:A:
Yes, this is starting to feel ridiculous. If, you're not planning to do it just say so, but don't leave us hangin' in there for nothing. The cost being an excuse seem lame compared to all the advertising this place has, both on site and elsewhere.

I'm tired of having all my PMs getting read in clear text from every below-the-average cafe' script kiddie.
[About XDA developers] selemine:
the ads are usually the argument why a page can't use tls. Some ad networks do not use tls so it wouldn't work when xda switches to tls.

I found a total of 3 third party servers used on xda that can't.

that is quite a low number, so I think we can ditch them
[About XDA developers] Jonny:
Not to put too finer point on it or anything but you should remember that the developer team behind this entire site consists only of 3-4 developers. The workload to maintain this site and develop new features, not to mention responding to real time issues as they come up, must be enormous. These guys are quite literally stretching the limits of vBulletin.
[About XDA developers] SecUpwN:
Yep, and they do a great job. But judging from the time of over ONE YEAR, they should've done better. Or at least start something! I truly can't believe that *nothing* has been implemented yet. Heck, I'd even skip News on XDA Portal for a week or more, if an implementation of such a BASIC security feature like HTTPS would take that long. Bring it on!