Implement SSL properly

[Ajdin]

Hello,

First of all, great that MCM implemented SSL. It surely is a positive step towards improving security on this website.

The SSL implementation isn't completely done right though.

For a whole website to be safely encrypted, all traffic on it needs to be SSL. This isn't the case on MC-Market.

Anyone can post an image that's just the good old "http" instead of "https". This has 2 massive downsides.

1. Most browsers will not load the content (in this case images)
2. Affects ranking in Google/Other search engines significantly. Webpages with 'http' sources are essentially considered unsafe.

I'd actually be more scared of the 2nd than the first. Google is trying to crack down heavily on insecure webpages. Since there's no exact number on how heavy this weighs on Google for a website, I can't give accurate numbers but I can imagine it is quite heavy on your Google ranking.

There's actually plenty of tutorials on how to implement SSL on XenForo properly. However, it's pretty simple:
Enabling SSL for a webserver is not hard. You purchase and install a certificate, restart your webserver, change some XenForo settings and tadaa.

There's a big part that MCM missed though. They need a reverse proxy to route traffic for all non "https". I'll use Spigot as an example:
Spigot routes all external traffic through their reverse proxy, http and https. This has a positive influence on loading speed due 2 reasons. The browser that visits the website only needs to go to 1 webserver which is Spigot's.

Go to this post as an example: https://www.spigotmc.org/threads/best-way-to-promote-my-minecraft-server.306955/
Right click on any image and copy the URL. You'll see it starts with "https://proxy.spigotmc.org/". This means, whatever kind of image you post on Spigot, it'll be routed through there. The proxy caches the image for quicker speeds. Additionally, it obviously makes the URL a https URL which is what MCM needs at this time.

With current's implementation, sure all login information is encrypted and such but I don't think visitors should have their browsers blocked from seeing regular http images.
Go ahead and visit a few threads, open your webconsole (CTRL + SHIFT + I), click on console and you'll probably see a bunch of errors like these:

I'm hoping to see this fixed.

For the noobies TL DR:
Fix this

 

[Ajdin]

Also worth mentioning that I talked about this previously: https://www.mc-market.org/threads/253482/page-4#post-2443555

However I wouldn't suggest going with XenForo's built in proxy. This would mean MC-Market.org would proxy all the images which means the website would directly connect with the image hosts. This is a very unsafe security practice as you're using Cloudflare. Users hosting these images sites would be able to see what IP the webserver is using thus DDoSing the site.

That's why Spigot has it hosted on a separate server "https://proxy.spigotmc.org/". To prevent image sites from getting Spigot's webserver IP.

This is actually extremely important to note down! Otherwise you'll definitely make yourself more vulnerable to DDoS attacks.

 

[Melon]

I believe that the proxy chaching is literally just one setting in the control panel, from what I remember, and it does it all automatically. The only downside is the huge storage needed for it all, but I'm sure with all the advertising money that won't be too hard to cover.

 

[Ajdin]

I believe that the proxy chaching is literally just one setting in the control panel, from what I remember, and it does it all automatically. The only downside is the huge storage needed for it all, but I'm sure with all the advertising money that won't be too hard to cover.

While this is the easiest solution, it definitely isn't the best:

However I wouldn't suggest going with XenForo's built in proxy. This would mean MC-Market.org would proxy all the images which means the website would directly connect with the image hosts. This is a very unsafe security practice as you're using Cloudflare. Users hosting these images sites would be able to see what IP the webserver is using thus DDoSing the site.

That's why Spigot has it hosted on a separate server "https://proxy.spigotmc.org/". To prevent image sites from getting Spigot's webserver IP.

This is actually extremely important to note down! Otherwise you'll definitely make yourself more vulnerable to DDoS attacks.

 

[Melon]

https://xenforo.com/community/resources/imageproxy-host.5030/
Found this on a thread brought up by md_5 himself, is that relevant at all?

 

[Ajdin]

Kinda lame that this still hasn't been resolved nor that any input was given from the staff team after half a year.

 

[Melon]

Kinda lame that this still hasn't been resolved nor that any input was given from the staff team after half a year.

Yeah its really bad. Literally 1 button to fix the entire problem

 

[Samuel]

Yeah its really bad. Literally 1 button to fix the entire problem

I'd say one button is way out.

 

[Melon]

I'd say one button is way out.

If you've looked at Xenforo's settings its one button to enable the image proxy and it does it all for you

 

[Ajdin]

I'd say one button is way out.

If you've looked at Xenforo's settings its one button to enable the image proxy and it does it all for you

Button or not, should have been resolved ages ago.

 

[Mick]

Button or not, should have been resolved ages ago.

It absolutely should have and I apologise for the delay.

I’ll move this to pending for us to implement very soon.


Thanks for the heads up Bosny

 

[Ajdin]

It absolutely should have and I apologise for the delay.

I’ll move this to pending for us to implement very soon.


Thanks for the heads up Bosny

Few months later without result.

 

[MTG]

Few months later without result.

mcm for you people

 

[Ajdin]

Okay. Let's all have a good laugh now.

The management behind this site manages to surprise me more every day.


This tweet is literally referring to the same issue as this thread. The only major difference is that this thread was posted in March and the tweet was just posted... If the issue is that serious that you had to disable embedded images all together, why wasn't it handled earlier?

You guys are so awful when it comes to suggestions and bug reports.

Also, the reasoning in the tweet is actually a fucking joke. Whoever told you to do that has no idea what they are doing.

 

[Landon]

Okay. Let's all have a good laugh now.

The management behind this site manages to surprise me more every day.


This tweet is literally referring to the same issue as this thread. The only major difference is that this thread was posted in March and the tweet was just posted... If the issue is that serious that you had to disable embedded images all together, why wasn't it handled earlier?

You guys are so awful when it comes to suggestions and bug reports.

Also, the reasoning in the tweet is actually a fucking joke. Whoever told you to do that has no idea what they are doing.

No, it isn't. This suggestion is referring to stopping mixed-content warnings, by forcing MC-Market to proxy images and use SSL on those proxied images. The issue with embedded images is your browser loading the image, which is masked by a PHP script saving the IP of the request to load that image. Different issues, same fix. But no, not the "same issue as this thread".

 

[Ajdin]

No, it isn't. This suggestion is referring to stopping mixed-content warnings, by forcing MC-Market to proxy images and use SSL on those proxied images. The issue with embedded images is your browser loading the image, which is masked by a PHP script saving the IP of the request to load that image. Different issues, same fix. But no, not the "same issue as this thread".

It's the same solution but the reasoning that they provided on twitter isn't really that logical.

Nonetheless, my point is that if they paid any decent attention to this thread, they would have known about the "privacy issue". What they are referring to in that tweet is the fact that anyone can embed any image into the site using the IMG tag, and the person behind the webserver would be able to pull all IP's that loaded the image from the server logs. I'm not sure why they went as far as disabling embedding images since this is how over 80% of the XF forums work and this is how MC-Market has been working for the past 4 years.

Also, disabling external images shouldn't be taken lightly. Many thread designs and signatures had to suffer because of this.

 

[Harry]

It's the same solution but the reasoning that they provided on twitter isn't really that logical.

Nonetheless, my point is that if they paid any decent attention to this thread, they would have known about the "privacy issue". What they are referring to in that tweet is the fact that anyone can embed any image into the site using the IMG tag, and the person behind the webserver would be able to pull all IP's that loaded the image from the server logs. I'm not sure why they went as far as disabling embedding images since this is how over 80% of the XF forums work and this is how MC-Market has been working for the past 4 years.

Also, disabling external images shouldn't be taken lightly. Many thread designs and signatures had to suffer because of this.

Yes, you mention the SSL privacy issue, which isn't exactally a priority, however you fail to grasp that this whole situation was sparked by the immediate vulnerability that IP addresses could be logged by the website owner. This suggestion would have prevented this, but not for the same factors/reasons (so it's not exactally justified to blame them for not acting on this suggestion).

Also, this is just a temporary solution...

https://www.mc-market.org/threads/415301/page-2#post-3452092[DOUBLEPOST=1542312026][/DOUBLEPOST]

Also, the reasoning in the tweet is actually a fucking joke. Whoever told you to do that has no idea what they are doing.

Again, I believe you fail to grasp the security vulnerability that was present, not due to mixed SSL content, but due to the fact that images were being loaded client-side, exposing the visitors IP address to the website owner (of where the image is posted).

I believe I was the one who originally reported this, and I was able to grab the IP address, location/coordinates, browser info and WHOIS information of over 2k MC-M visitors (in a two week period). Again, this data was deleted a while ago but shows the extent of this vulnerability.

In addition to this, an IP address of a certain member could be isolated via DMs.

Anyway, I'm not going to go on about the past, but I don't think you're justified when saying that they should've listed to you and acted immediately.

 

[Harry]

Sorry for the spam by me on this suggestion, but to be fair, I had a support request open for 5 months regarding the security vulnerability, but didn't get a response.

Justis has mentioned that he's updates the staff guidelines for how immediate security vulnerabilities are handled when reported through a support request.

This is the sort of information the vulnerability I reported exposes about any user Ajdin: https://cdn.majored.me/ip-image/my-ip-address

 

[Ajdin]

however you fail to grasp that this whole situation was sparked by the immediate vulnerability that IP addresses could be logged by the website owner

Also, the reasoning in the tweet is actually a fucking joke. Whoever told you to do that has no idea what they are doing.

I assume this was you?

That is the whole fucking point. An IP is NOT private information and shouldn't be considered as such in this context(except when you go into the GDPR but that's a whole different subject).

https://www.linkedin.com/pulse/ip-mac-addresses-personal-information-eric-lambert/

Just think about the fact that literally almost every forum has been functioning like this for the past many years so I'm not sure why you're pretending as if you've found some major security exploit.

I'm not saying a proxy is bad, not at all. I think it's great that they are adding it however it's just absolutely retarded that they are making a such big deal out of it and pretending like they've found out some major security exploit that nobody knew about before. Breaking all privately hosted images is literally absurd.