HTTPS for "MOD"

[Stels]

Is there a technical opportunity for the developers of the International Association of Detectives website to use the HTTPS protocol (optional by default), which will provide greater security for the information discussed on the forums? Surely this will be especially true for PRIVATE and SEMI-PRIVATE. In modern realities, merging the entire site (simply saying) and decomposing it “by the bones” is not a big deal.
For general development:
Https
HTTPS (HTTP Secure) is an encryption-enabled extension for the HTTP protocol. To protect the transmitted data, the cryptographic protocols TLS and SSL are used. By default, TCP port is 443 (for HTTP - 80).
The system was developed by Netscape Communications Corporation to provide authentication and a secure communication channel. Today, HTTPS is widely used for web applications requiring a secure connection. When search engine optimization sites take into account that this protocol is supported by the most popular browsers.
Features
HTTPS provides reasonable protection against sniffing attacks and threats such as man-in-middle, based on listening to the Internet connection, using a trusted certificate and effective encryption tools. This feature of the protocol makes it popular for promotion of commercial sites or containing confidential information.
This procedure is necessary for the effective promotion of websites of companies selling various goods or services via the Internet.
Encryption
HTTPS uses keys of 40, 56, and 128 bit lengths for encryption. 40- and 56-bit keys are unreliable; they were used in older versions of browsers. Modern sites require 128-bit keys (supported by the latest browser versions), encryption with which makes it very difficult for hackers (SORM-2) to search for passwords and other sensitive data.

 

[Руслан]

Balancing open access via HTTPS

 

[Симферополь]

Interesting! Incomprehensible !!

 

[Stels]

Ruslan, good evening! If it’s not a secret when HTTPS access is planned.
I would really like a safer chat HTTPS is not a panacea, but one of the elements of a set of measures to ensure our own security when located in a global network. Thank!

 

[Руслан]

HTTPS : https://forum.detective-agency.info

 

[@InfoPoisk]

Interesting! Incomprehensible !!

Quiet, Quiet.
Let smart people listen. : roll:: roll:: roll:

 

[Stels]

Ruslan! I went to the specified link.
Our system issued the following message:
“You asked the browser to establish a secure connection with forum.detective-agency.info, but we cannot guarantee that this connection is secure.
Usually, when you try to establish a secure connection, sites present a verified identifier, which serves as proof that you are going to the right place. However, the identifier for this site cannot be verified.
If you usually connect to this site without problems, this error may mean that someone is trying to replace this site with another. In this case, you should not continue the connection.

Technical details
forum.detective-agency.info uses an invalid security certificate.

There is no trust in the certificate, as it is self-signed.
The certificate is valid only for cp ca.crt / etc / pki / tls / certs
(Error code: sec_error_untrusted_issuer)

If you understand what is happening, you can ask the browser to start trusting the identifier of this site. Even if you trust this site, this error may mean that someone is wedging into your connection to the site. Do not add an exception if you are not aware of the good reason why this site does not use a trusted identifier. ”

For those who are interested:


An SSL certificate is not only necessary for distributing public keys: if it is signed by a trusted third party, it verifies the authenticity of the server so that clients know that they are not sending information (encrypted or not) to the wrong person. So what is a self-signed certificate? This is a certificate that is signed independently and not by a trusted third party. In most cases, yes. You will almost never want to use a self-signed certificate on a public server, which requires visitors to connect to your site, because they can easily become a victim of the “man in the middle” attack. However, self-signed certificates have their place:
Self-signed certificates can be used on the development server. There is no need to spend extra money to buy a trusted certificate when you are just developing and testing applications.
Self-signed certificates can be used on the intranet (internal network). When clients only need to go through the local intranet to get to the server, where there is practically no chance of a man in the middle attack.
Self-signed certificates can be used on personal sites with few visitors. If you have a small personal site through which insensitive information passes, there are very few incentives for someone to attack the connection (It is unlikely that someone will call the information on MOD “insensitive”.

In details:

SSL certificate is an individual digital signature of a domain.
He can be:
Self-signed. This means that you yourself issued a certificate, and yourself signed it.
Signed by an untrusted certification authority. This means that the site’s certificate is verified, but the “verifier” of trust is not awarded.
Signed by a trusted CA. This means that the certificate data has been verified by the company that has the right to do so.

A self-signed certificate does not guarantee anything. Anyone can take and issue such a certificate. All browsers give the client a warning that the certificate is not reliable.
A certificate signed by an untrusted CA does not confirm anything either. There are CAs that sell certificates to everyone and without verification. Most browsers respond to such certificates in a similar way to self-signed ones.

A certificate signed by a trusted source (for example, Thawte or VerySign) confirms that:
This site really belongs to the company for which it claims to be, and not to Vasya Fischer from the neighboring entrance.
The company that the site represents really exists in life, and not in Vasya’s thoughts from a nearby entrance.
The data of this company is verified and registered by a certification authority.

Browsers do not give an error on trusted certificates.

But it is technically. And now about what a trusted certificate shows to your site visitor:
-This is really the site we went to, and not face or phishing.
-The site was created in a serious and long-term. The owners laid out the money for the certificate.
-The site belongs to the company, or to registered physical. to a person, not to an unknown anonymous person. The advantages are clear - those who wish to cheat or steal rarely seek to prove their identity.
-The company cares about the security of information and the confirmation of its authenticity.
-If something happens, this company can be found through a certifier.

Many users (especially foreign ones - ours are not used to it yet), a self-signed certificate (or lack of SSL in things related to services \ finance \ privacy) may, if not scare it off, then put a bold minus in your favor.

Conclusion: on all sites related to personal, confidential, billing information, etc. SSL should be.

How to be

Regards, stels.

 

[Руслан]

Data encryption is ensured by the current certificate, and paying a ton of money so that someone does not confuse our site with another is not reasonable. If you are ready to be a sponsor in acquiring a certificate, we will be grateful for your contribution to the common cause and indicate you as the sponsor of this purchase.

 

[Орлан]

: shock:: shock:: shock:

 

[Частный детектив. Владивосток.]

: shock:: shock:: shock:

My eyes popped out a little more ...: lol: