Checked all my own security settings and they are all up to date, I wonder if this an issue with the BSS main server
or....Hopefully Admin can sort it out and let us all know why.
Site Security !
6 posts
• Page 1 of 1
Site Security !
by Jim Pritchard » Thu Apr 06, 2017 10:00 pm
Logged on to send my new e-mail addy to ADMIN, and noticed that this site is NOT secure !!!
Checked all my own security settings and they are all up to date, I wonder if this an issue with the BSS main server or....
Hopefully Admin can sort it out and let us all know why.
Checked all my own security settings and they are all up to date, I wonder if this an issue with the BSS main server
or....Hopefully Admin can sort it out and let us all know why.
- Attachments
-
ZB Custom S10 3+4, DD3 Digi delay, ZB vol. pedal. Peavey Nashville 400
- Jim Pritchard
- Seasoned Member
- Posts: 248
- Joined: Wed Jul 07, 2010 4:20 pm
- Location: Wimborne, Dorset. UK
- Real Name: Jim Pritchard
Re: Site Security !
by Arcada » Fri Apr 07, 2017 7:48 am
Short answer - I wouldn't worry about it.
Long answer: The BSS forum does not and never has had an SSL installed.
Google only recently (January - Chrome 56 - see https://security.googleblog.com/2016/09 ... e-web.html) started flagging sites as "not secure" if the page includes a password form or a request for payment details.
Since there have never been any payment details (credit card numbers / addresses etc.) requested by the BSS forum, there has never been any need to install an SSL. This only leaves the password field - you should, of course, follow the best practice security advice and use a different password for each website you use.
Previously adding an SSL would have added to the forum running costs. There are now free SSLs available (from https://letsencrypt.org/) which I've installed elsewhere, but their use would be complicated by the fact that the BSS forum uses Cloudflare for additional security measures (to dramatically reduce spam signups, and help against other attacks e.g. cross site scripting etc.) and Cloudflare is generally not compatible with SSLs not supplied by them (and they are particularly expensive for these).
So, it's a trade-off between the benefits off going through Cloudflare, or installing an SSL. And given the nature of the site (no payments details etc.) Cloudflare is the better of the two (IMHO).
Long answer: The BSS forum does not and never has had an SSL installed.
Google only recently (January - Chrome 56 - see https://security.googleblog.com/2016/09 ... e-web.html) started flagging sites as "not secure" if the page includes a password form or a request for payment details.
Since there have never been any payment details (credit card numbers / addresses etc.) requested by the BSS forum, there has never been any need to install an SSL. This only leaves the password field - you should, of course, follow the best practice security advice and use a different password for each website you use.
Previously adding an SSL would have added to the forum running costs. There are now free SSLs available (from https://letsencrypt.org/) which I've installed elsewhere, but their use would be complicated by the fact that the BSS forum uses Cloudflare for additional security measures (to dramatically reduce spam signups, and help against other attacks e.g. cross site scripting etc.) and Cloudflare is generally not compatible with SSLs not supplied by them (and they are particularly expensive for these).
So, it's a trade-off between the benefits off going through Cloudflare, or installing an SSL. And given the nature of the site (no payments details etc.) Cloudflare is the better of the two (IMHO).
-
Arcada - Site Admin
- Posts: 747
- Joined: Tue Jul 06, 2010 4:28 pm
- Location: Edinburgh, UK
- Real Name: Marc
Re: Site Security !
by Jim Pritchard » Fri Apr 07, 2017 9:22 am
Thank you Mark for the comprehensive explanation, all is now much clearer. 
ZB Custom S10 3+4, DD3 Digi delay, ZB vol. pedal. Peavey Nashville 400
- Jim Pritchard
- Seasoned Member
- Posts: 248
- Joined: Wed Jul 07, 2010 4:20 pm
- Location: Wimborne, Dorset. UK
- Real Name: Jim Pritchard
Re: Site Security !
by Arcada » Mon Jan 22, 2018 10:35 am
The technical limitations have been overcome, so the forum is now served over an SSL.
You should now access via https://www.thebritishsteeliessociety.co.uk, and you may need to login again as login cookies may not survive the switch.
The use of SSL is forced, meaning requests to the http://www.thebritishsteeliessociety.co.uk address are automatically redirected.
You should now access via https://www.thebritishsteeliessociety.co.uk, and you may need to login again as login cookies may not survive the switch.
The use of SSL is forced, meaning requests to the http://www.thebritishsteeliessociety.co.uk address are automatically redirected.
-
Arcada - Site Admin
- Posts: 747
- Joined: Tue Jul 06, 2010 4:28 pm
- Location: Edinburgh, UK
- Real Name: Marc
Re: Site Security !
by Danny Mitchell » Mon Jan 22, 2018 2:29 pm
Thanks for the heads up Mark.
Bookmark duly amended.
Bookmark duly amended.
GFI Ultra keyless S10 4+5 Emmon's setup + Sigler, Li'l Izzy, Hilton volume pedal, Roland Cube 80gx, Joyo American Sound Pre-amp, Behringer VD400 Delay Pedal, Peterson Strobo Plus HD and a brace of bars, Ben's, Ezzee-Slide, Pearse, BJS, SIT nickel strings.
-
Danny Mitchell - Dedicated Member
- Posts: 2210
- Joined: Wed Aug 27, 2014 11:15 am
Re: Site Security !
by Uncle Roy » Mon Jan 22, 2018 3:24 pm
Let me add my thanks Marc for what you do for the site and more.
It really is appreciated.
Thank you
Roy
It really is appreciated.
Thank you
Roy
-
Uncle Roy - Moderator
- Posts: 2802
- Joined: Tue Jul 06, 2010 3:59 pm
6 posts
• Page 1 of 1
Who is online
Users browsing this forum: No registered users and 1 guest