OpenPandora.org goes SSL!

[EvilDragon]

Just a quick info:
SSL encryption has been enabled for both the boards and the repo (for the repo, go to https://repo.openpandora.org, boards redirect automatically).

Of course, your browser reports some insecurity because of linked media and pictures on the boards, but login, etc. is secure now.

 

 

[TrashyMG]

Not sure if it's my end, but any hover over that has a pop-up (like user info and such) seems to just give me a spinning wheel loading image.

 

[WizardStan]

Yeah, confirmed, whenever I hover over a user I get "There was a problem loading this content"

 

[ptitSeb]

Welcome to the mixed content (https and non-s) nightmare...

 

[EvilDragon]

Argh - it seems IPB doesn't support full SSL yet, only for login then.
I'll change that then.

 

[Linux-SWAT]

It works here when I add the 's', but the top links link to http.

 

[levi]

Pages generally load, but little things break like mousing over usernames, editing and liking under HTTPS.

In other news, this reminded me to try to update my retro smartphone so I can view the boards and other places like wikipedia on the move.  Only problem is, I can't find the certificates on my Linux machine to install.

find /usr/share/ca-certificates/ -iname *.crt -print0|xargs -0 -I "[0]" openssl x509 -in [0] -noout -text|grep Subject:

gives me:

Subject: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
Subject: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
Subject: C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA, CN=TC TrustCenter Universal CA III
Subject: C=AT, O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH, OU=A-Trust-nQual-03, CN=A-Trust-nQual-03

That is, I don't see either the GeoTrust or RapidSSL certificates the OP boards certificate is signed against.  The firefox package doesn't seem to include any certificates itself as far as I can see, so where are those certificates on my system?

 

 

[lunixbochs]

Once you've confirmed SSL is working perfectly you should set HSTS headers (HTTP Strict Transport Security) to ensure users don't end up on HTTP by accident.

 

[Linux-SWAT]

Or man in the middle'd ;^) .

 

[rygD]

Or man in the middle'd ;^) .

I think this site may have been one of the ones I used for a demonstration of that.  I know I used it for personal testing.

 

[EvilDragon]

Fixed and fully working now

Enjoy the new SSL'ed site

 

[fusion_power]

Nice, but Spam-Bots still seems unimpressed.

 

[EvilDragon]

Yes, and it's still dark outside.
Which probably has as much to do as spambots do with SSL.

 

[Nintendo]

At least they're coming in as Guests this time around. 

 

[EvilDragon]

They shouldn't be coming anymore anyways since the Captcha has been fixed.
I also haven't seen any since then... have you?

 

[Nintendo]

When was  Captcha fixed?

 

[levi]

Ah, awesome.  I wondered why I was getting https pages again.

I figured out my previous Linux query for what it's worth - the certificates I was looking for are in /etc/ssl/certs.  No idea how they got there; the package manager disavows knowledge of where they came from.  Now just to figure out how to set a passphrase so I can obexftp over bluetooth to my phone.

 

[EvilDragon]

When was  Captcha fixed?

About four hours ago.

 

[Nintendo]

Ah ok, then its all good now then because the last time I saw them was approximately 10+ hours ago. Both were trying to sell us viagra. One wanted to lend us money to buy some hard-hitting or heavy duty stuff.

 

[notaz]

Fixed and fully working now

Enjoy the new SSL'ed site

Works fine here, thanks!