yashsingh1/xdaforums huggingface dataset:
[About XDA developers] ibrokemypie:
well the progress is certainly astounding...
[About XDA developers] selemine:
Depends on your Advertising Networks. They have to support TLS as well. Then you have to go through your CMS and get rid of all links that aren't protocol agnostic yet. It's not that easily done.
[About XDA developers] gregfrankenstein:
What baffles me is that the front page uses HTTPS, but the forum subdomain, where the actual logging in and downloading unverified zips takes place, doesn't. I mean it does for the half second I hit "login" and it redirects, but that doesn't help much when I could get my session stolen or be man-in-the-middled to download a fake ROM.
[About XDA developers] bitpushr:
Happy 2017, XDA is on HTTPS!

What you all have been dreaming of is finally a reality!

We have moved all XDA pages to HTTPS! It was a long time coming but we are finally a secured website.

There may be a few issues with ads on the https site, we are working with our ad partners to fix those. Meaning that the green "Secure" text shown in Chrome or other browsers may switch to grey on some pages. Also we have tested pretty well with the 2015 (default) theme, there may be some issues on 2010 and 2013 themes that we are working out to fully secure those as well.

If you run into any problems relating to the move to https, please post them here with screenshots and logs whenever possible.

Thank you all for the support, I definitely talked up the demand for https on the site and have been wanting to make this move for a long time.
[About XDA developers] sd_shadow:
[MENTION=5101348]nikwen[/MENTION] / [MENTION=4465234]benkxda[/MENTION] it's time to change the thread title to

XDA is Secure !

Thanks [MENTION=450224]bitpushr[/MENTION] , and others that helped make this happen.
[About XDA developers] TheAltruistic:
I hope this happens. I voted for this to be put on the portal. We need more support for this! :D
[About XDA developers] KidCarter93:
I've seen quite a few threads in this part of the forum regarding fake XDA sites. Is this how they do it then?
[About XDA developers] pulser_g2:
Uhhh wtf?

Question makes zero sense, trying to answer in sensible way...

1) None of the "fake" sites have ever used SSL.

2) The fact that at present the public part of XDA isn't over SSL would mean that a "fake" one offering it would be identifiable :p

3) "imposter sites" don't operate by stealing SSL private keys.
[About XDA developers] nikwen:
I don't think that this should be a reason for prefering http to using the more secure https. :D
[About XDA developers] pulser_g2:
Kindly read the post before trying to be "smart" - the question asked was utterly clueless in purpose - it doesn't make technical sense, nor practical sense... And the fact people are asking for HTTPS to be supported shows the question makes no sense...

How can someone be "stealing ssl keys" of a site that doesn't use SSL?

I look forward to the attempt at a response ;) Did I at any time say it was a reason TO use HTTP? Or are you making things up now?
[About XDA developers] nikwen:
First of all, I didn't say anything about his question.

To me it just sounded like "Hey, it's an advantage that we use http. That way we know that a site would be a fake if it ever used SSL.".

Seems like I have got you wrong. Sorry for that.
[About XDA developers] pulser_g2:
OK, no I was saying how absurd the question was, as it wouldn't be relevant unless XDA was over HTTPS.

Say xda was over HTTPS, to successfully "pretend" to be XDA, you would need a certificate issued in our name, under our domain. Otherwise, that's no use.

To actually "intercept" traffic, you'd need our SSL private keys. And in fact, that wouldn't even be sufficient, as we would use forward secret SSL.
[About XDA developers] bitpushr:
Hey all,

Wanted to give you an update on this. It IS on our radar, it is just with a site of our size it isn't as simple as just turning on https. We have used https for years on our backend services.

It is really a two-fold problem, but nothing that we can't overcome.

The first is that our current CDN wants an arm and a leg to provide https for our cdn assets. We are working to move to a new provider who provides https for a much more reasonable rate.

This is the main thing that is preventing us from just moving everything over. Without all assets on the page being loaded over https, browsers will throw a warning.

The second is that a year or so ago I tried to move just the login to https. It ended up breaking the ability for everyone to login, I believe due to how vbulletin handled sessions. So that system will need a bit of re-engineering.

So the good news is we are working on this. The bad news is that I don't have an estimated time for when it will go into effect. For me the preferred timing is "as soon as possible". [MENTION=2178960]pulser_g2[/MENTION] and I have been talking about this for a while :)

For those really interested in https technology, I do have https running using forward secrecy. So we won't have the problem of people decrypting https streams down the line.
[About XDA developers] JokerAce:
I have voted. And this page sorta nudge me. I try to be as careful as possible with my internet usage, e.g. my browser doesn't save form datas and neither do I tick checkbox that "helps" to remember my passwords. As human, complacency do set in once in awhile.

After reading this thread, I sort of realize how much trust I place on XDA on the whole. Its like a brightly painted picture where I am so focused on the beauty of XDA, that I overlooked the black spots that may be lurking around!

As [MENTION=2178960]pulser_g2[/MENTION] seems to try to put it across to us, if "WE" (individual we(s)) are really worth the targets of hackers, we better be worried about more stuff greater than this site itself, your bank log-in details for instance. In the meanwhile I suggest users to be vigilant in what you do with your phone, especially so, since these days we are doing what we do on desktops on phones now.

Well, in short, I am definitely supportive for this https initiative.

[MENTION=450224]bitpushr[/MENTION] I hope for you that the challenges you face will be dealt with soon :good:
[About XDA developers] nikwen:
We've just reached 100 supporters. :)
[About XDA developers] Thingula:
I'd like an HTTPS connection, too. However, [MENTION=450224]bitpushr[/MENTION] made some great points. I know (from some experience) that HTTPS is quite a bit more difficult to set up than most people may think. Even if you ignore things such as forum compatibility and the cost of traffic (which is relatively high with the most trusted providers) there are still issues of browsers mistaking it for a bad certificate, slower connection speeds, and even a higher false sense of security in the case of a certificate being stolen (very unlikely, but has been successfully done against PayPal, Bank of America, and others).

It makes a lot of sense to use HTTPS with all of the extremely sensitive data that flows through this site, but I just wanted to help some people understand some of the roadblocks for setting it up on any site.
[About XDA developers] benkxda:
Wow, currently we are at 151 votes, before I reloaded this window, it was 150. Hopefully we still get more votes. Thanks to all of you, who think we need a more secure XDA. Honestly, I don't mind, if there are other improvements beside "just HTTPS". :)
[About XDA developers] andersonpaac:
512 bit certificates

We dont' just need HTTPS , but we need larger encryption keys and make sure the admin does actually manage and not give away the keys without sending a mail out to all the members.
[About XDA developers] psytr0nic:
I voted , because we need it !
[About XDA developers] nikwen:
Thanks for your support. ;)

By the way, we've reached 222 votes. :)
[About XDA developers] E:V:A:
I was wondering why so few people have voted, but then I noticed that the

poll question is poorly formulated. It should be a YES/NO idea.

WTF does "I'd kill for that feature!" mean? (They're both YES in my opinion.)
[About XDA developers] nikwen:
Yes, there are only YES options. I decided to do that because the people who do not want it don't really matter to us.

Have you ever seen a petition with a NO option?

"I'd kill for that feature" is an ironic sentence meaning something like "I would do anything - even kill - if I just got this feature".

In my opinion the reason for the low vote count is that nearly nobody checks the About xda forum regularly. So this thread has got only 3400 views yet.

Btw, thanks for putting a link into your signature. :good:

EDIT: 224 supporters yet.
[About XDA developers] Mexickano:
A site with more security means more users, more user means possible more donators, more developers and more fun for XDA.
[About XDA developers] CatalystWon:
As of this writing we have 289 votes (including mine).

How many votes before this gets posted on the portal? I only learned of it by accident from another XDA user's signature.

I've been using the Electronic Frontier Foundation's Firefox extension HTTPS Everywhere for a long time and have always supported HTTPS.
[About XDA developers] E:V:A:
I'd like to propose another thing here as well.

I'd like to be able to see the following:

The IP address of last n XDA logins.

Some browser fingerprint info. Perhaps even hashed so that it can't be manipulated, and compared on each login.

I'm not sure, but perhaps this would need it's own thread?
[About XDA developers] benkxda:
Thanks for this idea. I don't know much about the privacy law in USA beside the very much discussed safe harbor. At least European data protectors mostly disagree, that this is enough protection. However, storing complete IPs would not be allowed generally. Also, fingerprinting a browser is also well discussed and maybe is unlawful as well (in Europe), but this would depend. In the case of logging into a platform like XDA, it might be not allowed.

Beside the European law, which does not count in USA, do you want that XDA collects more data than it must for working properly? I am very undecided between security and data privacy somehow.
[About XDA developers] E:V:A:
Well given the fact that Google does store this (Gmail IP login location) information and the most recent NSA revelations, I would find it funny if XDA wasn't allowed to store this for our best awareness sake, since we don't have any privacy anyway. Unless XDA wanna introduce a two factor authentication. (Which would be very expensive and counterproductive at this time, if not also useless, against the long reaching fingers of the US gov.)

The idea behind the above suggestion, is to give you a minimal level of awareness in case your XDA account has been compromised, although an SSL MITM attack still wouldn't let you know anything.
[About XDA developers] Thingula:
I don't know.. That always pisses me off when I get the "You're using a different computer." message..
[About XDA developers] nikwen:
I contacted Will Verduzco, the portal admin, once. He just redirected it to the other admins.

You could try to send another request: http://www.xda-developers.com/suggest-content/
[About XDA developers] nikwen:
Well, I wouldn't prefer that. I don't really want that information to be stored.

I think that we should focus on https first and then care about other security concerns. In my opininion https is the most important thing at the moment.

However, afterwards we could ask for other security changes like yours. But if they implement that one, I hope that they will let me disable it. ;)
[About XDA developers] CatalystWon:
Request sent! :good:

I agree. A valid suggestion but it belongs in its own thread. Lets focus on one thing at a time. :)
[About XDA developers] nikwen:
Great. :)

Let's hope that they'll listen to us this time. :good:

Btw, we got over 300 votes. :)
[About XDA developers] CatalystWon:
Votes are moving upward! :victory:

Its all about visibility + education. I'll bet less than 1% of XDA members know about this. :(

If you are new in this thread, please add your support to nikwen's request per post #44 above, and contact the XDA-Portal administrator at: http://www.xda-developers.com/suggest-content/
[About XDA developers] nikwen:
You're right. Nearly nobody knows about this. Just look at the view count: 4,768

And we've got >5,200,000 users.

First of all, thank you very much for what you've done. However, I think that we shouldn't spam them.

Would it help? I don't think so. They announced that they're working on it and every vote could speed up the process.

But if the portal team doesn't want to feature it after the second or third request, they probably have some reasons for it. Would you want to put pressure on yourself? ;)

Don't get me wrong. It's great that you contacted them again. Thank you very much for that. But spamming them might be destructive. ;)

In my opinion putting links into our signatures is the best thing we can do at the moment.
[About XDA developers] CatalystWon:
Out of 4,768 views only 300 votes? :confused:

As they have taken the time to explain here, both their interest and that they are working on it, I think we should give them the time they need to address it.

First of all, its not spamming (like the trash we get in our inboxes); we are XDA members legitimately trying to improve our XDA website. Secondly, one could assume they get lots of requests for lots of things; if that is the case then numbers do matter. But in this case it looks like they already got the message and are working on it, and for now its the votes that matter.

I agree, but if only a handful of us have it in our signatures, very few users will actually see it as most of us post in just a limited number of threads. Everything in my signature is there for a reason and I am out of space. If I can increase my signature-space allowance, I will gladly add the link. :good:
[About XDA developers] nikwen:
Yep. Strange. :confused:

However, many of the views might be from people who are subscribed to the thread.

Sure. :good:

Do you get trash in your inbox? :eek:

Of course, we want to improve XDA. But I'd call it spam if we sent them many portal requests because they did not respond to any.

But let's not argue about that. ;)

I'm out of space, too. ;)

I can't add my latest tutorials. :(
[About XDA developers] deathnotice01:
It's encrypted with hash you bunnies.

So only those that can reverse the algorithms can hack your XDA.

---------- Post added at 05:04 PM ---------- Previous post was at 05:00 PM ----------

Here's some cookie analytics as well.

Nothing to worry about.

---------- Post added at 05:18 PM ---------- Previous post was at 05:04 PM ----------

Even nothing in Hex Traffics, still it's MD5 encrypted.
[About XDA developers] nikwen:
Cool. :cool:

However, I don't really understand that. What does it mean except that the password is encrypted? :confused:
[About XDA developers] nikwen:
Btw, 24 votes within less than 20 hours. :eek: Cool. :D

EDIT: And 8 people since this was posted 3 hours ago. Where are you all coming from? :D

But I shouldn't complain... :laugh:
[About XDA developers] benkxda:
A lot of blurred content, although it is nothing to worry about.

I don't know when we got this line completion in the login form. To me this is new:

referring to

This is not bad, as it's much harder now to get the password. But it should be still possible to hijack a session, XDA probably has also a fallback option if cookies are not accepted. I did not proof that, I just guess as this is very common. But maybe there are HTTP_USER_AGENT strings hashed as well and are compared to the one who (first) logged in with each (GET/POST) request.

However, the transferred content at least (like fora, threads, posts and of course PMs) is not encrypted afaik.

EDIT: Link corrected.
[About XDA developers] deathnotice01:
I didn't check the traffics for posting / PM contents.

I thought this was about encryption of password and personal info only :D

I'll try and grab those if i have some more time :)
[About XDA developers] :
I am also with you bro, go ahead, if u need a proper site or this, we can provide you, just drop a request at Websites Hub... :)
[About XDA developers] nikwen:
Wow, thank you very much. I didn't know there was this thread. Great idea. :good:

However, benkxda and I created this as a thread and not on a petition website (or any other website) to make sure that only XDA users can vote and that they can vote only once.

But if you want to create a website to promote this, I won't answer no. ;)
[About XDA developers] nikwen:
And we've got 400 votes. :)
[About XDA developers] Sanjay:
But how http is helpfull?

Sent after :stirthepot:
[About XDA developers] nikwen:
Yeah, looks like they've set up some encryption when you login. However, we still want https. ;)
[About XDA developers] Mardon:
I think the new encryption is because we now can assign a google account to our xda account.

Gesendet von meinem GT-S5830 mit Tapatalk 4
[About XDA developers] nikwen:
That would actually make sense. :D

Thanks. :good:
[About XDA developers] Sanjay:
Hey I got!

Sent by 桑傑庫馬爾 :stirthepot:
[About XDA developers] benkxda:
I am not definitely sure, but I guess, the Google account is working different.

This is our login form (not a secret, everyone can check this). Recently I got mentioned that there is kind of encryption by a Javascript for our typed in data.

<form action="/login.php?do=login" method="post" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 0)">

<input type="text" name="vb_login_username" id="navbar_username" accesskey="u" tabindex="101" value="User Name" onfocus="if (this.value == 'User Name') this.value = '';" />
<input type="password" name="vb_login_password" id="navbar_password" tabindex="102" />
<label for="cb_cookieuser_navbar"><input type="checkbox" name="cookieuser" value="1" tabindex="103" id="cb_cookieuser_navbar" accesskey="c" checked="checked" />Remember Me?</label>
<a id="forgotPass_navbar" href="/login.php?do=lostpw">Forgot your password?</a>
<input type="image" src="/images/new_login.png" class="button" value="Log in" tabindex="104" title="Enter your username and password in the boxes provided to login, or click the 'register' button to create a profile for yourself." accesskey="s" />
<input type="hidden" name="s" value="" />
<input type="hidden" name="securitytoken" value="guest" />
<input type="hidden" name="do" value="login" />
<input type="hidden" name="vb_login_md5password" />
<input type="hidden" name="vb_login_md5password_utf" />
</form>

For the Google account login there is a separate website popping up:

<div id="xda_header_google_login" style="float: right;">
<a class="google-login" id="google_login" href="/social-login/google.php"><img src="/images/btn_white.png" style="width: 100px; height: 34px; margin: 5px 0px 10px 0px;"></a>
</div>

In combination with this Javascript:

<script type="text/javascript">
jQuery(document).ready(function($)
{
jQuery('.google-login').click(function(e)
{
e.preventDefault();
var url = $(this).attr('href');

var login_window = window.open(url, '1367260649051', 'width=700,height=500,toolbar=0,menubar=0,location=0,status=1,scrollbars=1,resizable=1,left=800,top=300');

var timer = setInterval(function()
{
if (login_window.closed)
{
clearInterval(timer);
window.location = '/?nocache=1';
}
}, 1000);
});
});
</script>

I guess XDA gets a true or false back from Google. So XDA won't see our GOOG login data, they get only back a "yes, account is veryfied, access granted" or the get a "no, wrong login data, access denied". I never used this Google login APIs, but this is the way it usually works afaik.
[About XDA developers] Mardon:
I dont meant its for google login i meant they made a higher security lvl now because we can assign a google account to our xda account.

Gesendet von meinem GT-S5830 mit Tapatalk 4
[About XDA developers] benkxda:
Oh, this way, ok. Misunderstanding. Yes, this is possible, indeed. And we hope for still more improvement. :fingers-crossed:
[About XDA developers] deathnotice01:
Bottomline:

With HTTPS we'll have additional security not much as what XDA has in place now but still a little more won't hurt.

We're all still vulnerable to MITM attacks irregardless of HTTPS.
[About XDA developers] LordManhattan:
- I want https!: 321 votes

- I'd kill for that feature!: 104 votes

Well, looks like the NSA will add 104 new individuals to their list.
[About XDA developers] nikwen:
Haha. And I'm one of them. :eek:
[About XDA developers] mynote:
I dont think that https is important on XDA. There are not really "dangerous" or very privacy informations which Need to be covered.
[About XDA developers] nikwen:
I agree that there is more private information out there than on XDA (banking data, etc.). However, I still think that it is important.

Quote from the OP:

The download files, well, self-explanatory.

Very important for me: There are some people I chat with on XDA. We use PMs for that and in those messages you CAN find private information. And I want them to be secure. (Not that you would find information like where I live or my full name. But there is still private information like what we do all day.)

Https might not be important for people who don't use XDA that often, but I think that for those who are very active it IS important.
[About XDA developers] benkxda:
Frankly, I wanted to answer with the very same example, the PMs. They are quite an important way to communicate with some people or groups beside public places. This function is built in exactly for confidential conversation among the members. If I wanted those conversations published to public, I would use the forum and post to public. And it's its content, which is private - even if I would just say unimportant things like I can't wait for the Nexus 5, the weather is beautiful or something obvious ;).
[About XDA developers] niredec:
I'd kill for that feature! but...

I'd kill for that feature! but it doesn't matters. The privacy is a crime for NSA and the world in general...

The last day I was in a wordpress conference, and in a conference the topic was how to block access tor users to a wordpress blog.

The speaker thought that any user what use a tor network is a black hacker, it's a criminal.

If in this world anyone that wants privacy it's a criminal, I'm absolutely guilty. Privacy rules!, https rules!. Hello NSA!

Hopefully continue to exist Internet privacy!
[About XDA developers] nikwen:
[MENTION=450224]bitpushr[/MENTION]: Any update on this?

Btw, we've already got more than 500 votes. :)
[About XDA developers] Cooptx:
I think this is a great idea. Recently, there has been a case of account hacking. The hacker then used information found by that account to get into all of the other accounts and completely decimated the victims website and other things. XDA should see this as a serious issue. I am perplexed about why they didn't expect a community of hackers and computer geniuses to turn on each other and start hacking things.
[About XDA developers] nikwen:
Yeah, we are a community of developers and we don't manage to get https working, while forums for photographers or sailors are able to do that. (German links, sorry. ;))

Btw, thanks for putting the link into your signature. :)

[MENTION=450224]bitpushr[/MENTION]: Yes, I read your post about why it takes so long. ;)
[About XDA developers] sinlimites:
I think is a good idea, so the filters in some proxys block the page.
[About XDA developers] nikwen:
I don't really get your point. Why would that be helpful?

Thanks for your support though. :good:
[About XDA developers] sinlimites:
Sometimes enterprise proxies block pages due to the content of the page. If this content is send encrypted the proxy can not filter blocked keywords.
[About XDA developers] nikwen:
Ah, thanks. :)
[About XDA developers] benkxda:
A really good point. And those proxies may be used in companies, but also may exist in countries with weak or poor democracy.
[About XDA developers] Osamabinatiq:
:thumbup:
[About XDA developers] HB-1:
signed