"Site Not Secure"

[The Purist]

Noticed this morning that I am receiving bright "red" warning in the site address stating site is not secure and risk of attack is "high"

Some sort of security button not flipped at GS this morning?

 

[Sparafucil3]

You're using the http address. Those are always "insecure". When you do banking, you're using the https address. Those are supposed to be secure and involves certificates which cost a lot of money. I tried the https://www.gamesquad.com but I got connection refused. My guess is it is not configured but I am not the site owner. You would have to as @RandyT0001 -- jim

 

[Michael R]

I didn't expect GS to have a https url because it doesn't involve money except for supporters making their contribution. That should be secure, although I do not know if it is. I just looked at BGG for comparison, and it is https, surprisingly to me. FaceBook is secure. CSW is not.

 

[zgrose]

https everywhere is the target. there is a $ fee to be paid at the moment which is the main driver it isn't everywhere already.

 

[WargameHQ]

There are free ssl providers out there. SSL everywhere is one, but the leases can expire and need to be renewed. It’s pretty simple so there’s really no excuse not to have one at this point.

 

[Sparafucil3]

There are free ssl providers out there. SSL everywhere is one, but the leases can expire and need to be renewed. It’s pretty simple so there’s really no excuse not to have one at this point.

Is it a trusted cert provider? If it is, then no one will get the nasty warning. If it isn't, it's not much better. -- jim

 

[WargameHQ]

https://letsencrypt.org/

i use it on all the sites I’ve run or manage both personally and commercially.

what makes it great is a little tool called certbot that does the heavy lifting For registration and renewal.

 

[WargameHQ]

I didn't expect GS to have a https url because it doesn't involve money except for supporters making their contribution. That should be secure, although I do not know if it is. I just looked at BGG for comparison, and it is https, surprisingly to me. FaceBook is secure. CSW is not.

SSL certs don't cost a penny and can be automated.

Certbot

Tagline

certbot.eff.org

 

[uckelman]

Are there any plans to add HTTPS support? A lot of browsers now toss up a scary warning for HTTP, and you can get a Let's Encrypt certificate for HTTPS for free these days. (That's what we use at vassalengine.org.)

 

[Cattlesquat]

Here is what it looks like full-screen on my browser when I try to come to this site. Every time.

 

[Robin Reeve]

About twenty spam posts are destroyed by the moderators every day.

 

[uckelman]

About twenty spam posts are destroyed by the moderators every day.

What's the relevance of that to the site using HTTP instead of HTTPS?

 

[Robin Reeve]

What's the relevance of that to the site using HTTP instead of HTTPS?

I am not learned at that level, sorry.
I tried to give a possible explanation of the warning.
Those spam-bot posts are fraught with links which certainly lead to dangerous sites.
Don't you think that they could be one of the reasons of the warning?

 

[uckelman]

I've already given the reason for

I tried to give a possible explanation of the warning.
Those spam-bot posts are fraught with links which certainly lead to dangerous sites.
Don't you think that they could be one of the reasons of the warning?

No, those aren't the reason for the warning. The reason is the one I've already given: The site is being served over HTTP instead of HTTPS.

The site admins risk losing a good chunk of their traffic if they don't fix this.

 

[Robin Reeve]

There is only one site admin.

 

[uckelman]

Same point applies no matter how many admins there are.

Well, I've identified the problem and the solution. I'm done. ¯\_(ツ)_/¯

 

[PresterJohn]

It would be nice if I didn't have to have an exception for "site not secure" for GS.

It's not as if the default rules in modern browsers are not there for a reason.

 

[KhandidGamera]

It would be nice if I didn't have to have an exception for "site not secure" for GS.

It's not as if the default rules in modern browsers are not there for a reason.

Here, here. It is 2022. GS owners might want to get the net. Annoying as all hell.

 

[Jazz]

The site admins risk losing a good chunk of their traffic if they don't fix this.

Mayhaps they will lose some of the phishing traffic?

 

[uckelman]

What phishing traffic? What are you talking about?