Update: Cloudflare service has been successfully deployed and https is from now on enforced, insecure http is now forcefully redirected to secure communication.
It appears authentication password for Ember forums is currently going through potentially insecure channels in plain text which can be stolen in transit.
Risks:
Mild annoyance: Member loses access to account until mods help him restore it.
Major threat: Member is using same password here as everywhere else so somebody snatching the password while in transit can cascade to loosing access to his email account and then other services (would also defeat email two-way authentication - not that it matters much at this point
).
Solution:
It appears authentication password for Ember forums is currently going through potentially insecure channels in plain text which can be stolen in transit.
Risks:
Mild annoyance: Member loses access to account until mods help him restore it.
Major threat: Member is using same password here as everywhere else so somebody snatching the password while in transit can cascade to loosing access to his email account and then other services (would also defeat email two-way authentication - not that it matters much at this point
).Solution:
- Obtain SSL certificate
- Pros: Easy to maintain and setup
- Cons: Costs money (quite enough with wildcard cert)
- Move to CloudFlare reverse proxy
- Pros: FREE, Fast/Easy to setup, TLS communication, very little maintenance, DDOS protection, Content delivery network, saves bandwidth
- Cons: None that I can think of (I'm using it myself).
- Implement Let's Encrypt certificates
- Pros: FREE, automated, open, backed and sponsored by many major companies
- Cons: Can be difficult to setup, certificate needs to be reissued every 3 months manually if automation isn't implemented.
Last edited:
