Implement SSL properly

[Ajdin]

Hello,

First of all, great that MCM implemented SSL. It surely is a positive step towards improving security on this website.

The SSL implementation isn't completely done right though.

For a whole website to be safely encrypted, all traffic on it needs to be SSL. This isn't the case on MC-Market.

Anyone can post an image that's just the good old "http" instead of "https". This has 2 massive downsides.

1. Most browsers will not load the content (in this case images)
2. Affects ranking in Google/Other search engines significantly. Webpages with 'http' sources are essentially considered unsafe.

I'd actually be more scared of the 2nd than the first. Google is trying to crack down heavily on insecure webpages. Since there's no exact number on how heavy this weighs on Google for a website, I can't give accurate numbers but I can imagine it is quite heavy on your Google ranking.

There's actually plenty of tutorials on how to implement SSL on XenForo properly. However, it's pretty simple:
Enabling SSL for a webserver is not hard. You purchase and install a certificate, restart your webserver, change some XenForo settings and tadaa.

There's a big part that MCM missed though. They need a reverse proxy to route traffic for all non "https". I'll use Spigot as an example:
Spigot routes all external traffic through their reverse proxy, http and https. This has a positive influence on loading speed due 2 reasons. The browser that visits the website only needs to go to 1 webserver which is Spigot's.

Go to this post as an example: https://www.spigotmc.org/threads/best-way-to-promote-my-minecraft-server.306955/
Right click on any image and copy the URL. You'll see it starts with "https://proxy.spigotmc.org/". This means, whatever kind of image you post on Spigot, it'll be routed through there. The proxy caches the image for quicker speeds. Additionally, it obviously makes the URL a https URL which is what MCM needs at this time.

With current's implementation, sure all login information is encrypted and such but I don't think visitors should have their browsers blocked from seeing regular http images.
Go ahead and visit a few threads, open your webconsole (CTRL + SHIFT + I), click on console and you'll probably see a bunch of errors like these:

I'm hoping to see this fixed.

For the noobies TL DR:
Fix this

 

[Harry]

Yes, obviously people knew about it before, but I don't think anyone had realised how it could be exploited.

As I've already hinted at, this isn't just an IP address. The approximate location/coordinates, ISP, browser information and potentially a member if correlated via a DM , which could be done automatically.

From this information, and any public information on their profile, someone could be identified via social media or other methods.

I'm not saying this is the vulnerability of the century, just that you're underestimating how it could be exploited. I'm sure you wouldn't want a visitor on your own site to be able to do this? If you would, I would gladly setup a script to log visitors and we'll see how your customers feel about that... Ajdin

Anyway, I'll gladly take this to DMs as I don't want to ruin this suggestion thread.

 

[Ajdin]

The approximate location/coordinates

The longitude and latitude are pulled from the IP whois and are completely incorrect. They are roughly accurate to 50ish km's but this usually higher depending on the ISP. ISP isn't private information either.

we'll see how your customers feel about that... Ajdin

Just like services such as Google, Facebook, use this information for other services? If people are that paranoid about having their IP exposed, they should use a VPN. Kids on this forum are braindead anyways and will open any link you send them. So to now break all image tags without getting to a solution first is definitely overreacting.

The largest Xenforo forum in the world, ign.com/boards, doesn't even have a proxy in place.

The EU privacy commission was close to declaring an IP address as non-private information when working on the GDPR. Right now, IP addresses aren't considered private information if you remove the "host identifier" part which are the last digits. Without the host identifier part, you are still able to see the longitude and latitude (which are never even close to accurate), the ISP, country etc and other details which you'd be able to see. If the EU privacy commission doesn't consider this personal information(and they are usually extremely paranoid), why should you? lol

If you were the person that contacted the MC-Market staff, they most likely overreacted, saw the latitude information and removed the image tags.

But yeah, you probably know more than the people behind IGN's 1.2mil member forum.

 

[Harry]

The longitude and latitude are pulled from the IP whois and are completely incorrect. They are roughly accurate to 50ish km's but this usually higher depending on the ISP. ISP isn't private information either.


Just like services such as Google, Facebook, use this information for other services? If people are that paranoid about having their IP exposed, they should use a VPN. Kids on this forum are braindead anyways and will open any link you send them. So to now break all image tags without getting to a solution first is definitely overreacting.

The largest Xenforo forum in the world, ign.com/boards, doesn't even have a proxy in place.

The EU privacy commission was close to declaring an IP address as non-private information when working on the GDPR. Right now, IP addresses aren't considered private information if you remove the "host identifier" part which are the last digits. Without the host identifier part, you are still able to see the longitude and latitude (which are never even close to accurate), the ISP, country etc and other details which you'd be able to see. If the EU privacy commission doesn't consider this personal information(and they are usually extremely paranoid), why should you? lol

If you were the person that contacted the MC-Market staff, they most likely overreacted, saw the latitude information and removed the image tags.

But yeah, you probably know more than the people behind IGN's 1.2mil member forum.

If this is the way you feel, would you mind me setting up a script on your site to log your visitors?

Also, my ISP has set their location at their nearest exchange, which is only about 5 miles from. Also have a friend who's location shows about 500m away, so it's often more accurate that you're lead to believe.

 

[Ajdin]

If this is the way you feel, would you mind me setting up a script on your site to log your visitors?

You literally just ignored everything I said and only got back to your shitty point ignoring all my valid other points.

1. The power of including a script into a site isn't even close to the limitations of including an image has.
2. If I actually had a good reason to include an image from an external server onto my site, I would yes. But I don't have a reason to do so.

 

[Harry]

You literally just ignored everything I said and only got back to your shitty point ignoring all my valid other points.

1. The power of including a script into a site isn't even close to the limitations of including an image has.
2. If I actually had a good reason to include an image from an external server onto my site, I would yes. But I don't have a reason to do so.

You're again missing my point. The whole image thing allows a PHP script to be run on the webserver, allowing all this information to be logged. I could setup the same script on your site, and that's the point I'm trying to make.

If there was no concern at all, let me setup this script on your site, snd you'll be proving me wrong...

 

[Ajdin]

You're again missing my point. The whole image thing allows a PHP script to be run on the webserver, allowing all this information to be logged. I could setup the same script on your site, and that's the point I'm trying to make.

How does it allow a PHP script to be ran on the server? If that's the case, this is a major Xenforo bug?

From what I understand, the image host is able to pull the visitor's IP and execute that on the image host's end, not Xenforo? If so, that's still no risk and literally doesn't change anything.

 

[Harry]

How does it allow a PHP script to be ran on the server? If that's the case, this is a major Xenforo bug?

From what I understand, the image host is able to pull the visitor's IP and execute that on the image host's end, not Xenforo? If so, that's still no risk and literally doesn't change anything.

Ah, I misread what you said. I meant that instead of just including the direct image link (which doesn't really do much except logging in access logs), the link to a PHP file could be included and that script would be run (which could generate an image as normal as well as logging all the information I've mentioned). This is on the webserver where the supposed image is being hosted.

I collected information on over 2k MC-M visitors (in a two week period), how is that not an vulnerability?[DOUBLEPOST=1542373757][/DOUBLEPOST]Look, I'll take this do DMs with you as this is getting out of hand.

 

[Landon]

I'm aware this is "Pending" and not "Accepted", which means it isn't fully integrated, but SSL implementation shouldn't be taking this long.

For the most part, SSL is working, but still some mixed-content issues:

"Loading mixed (insecure) display content “http://image.ibb.co/cbnnKG/thinking4.png” on a secure page"

It seems as if the emote isn't hosted on MC-Market, but otherwise on IBB (which does support SSL, by the way). It'd probably be better to move that emote and (https://static-cdn.jtvnw.net/emoticons/v1/25/1.0) to MC-Market's server and use MC-Market related links, rather then depending on a third party.

That's the only SSL issue I've found, and it's such a simple fix to have MC-Market fully SSL enabled.

 

[Ally]

It seems as if the emote isn't hosted on MC-Market, but otherwise on IBB (which does support SSL, by the way). It'd probably be better to move that emote and (https://static-cdn.jtvnw.net/emoticons/v1/25/1.0) to MC-Market's server and use MC-Market related links, rather then depending on a third party.

I already suggested this in another suggestion, which hasn't been active for a while now.

 

[Ajdin]

I'm aware this is "Pending" and not "Accepted", which means it isn't fully integrated, but SSL implementation shouldn't be taking this long.

For the most part, SSL is working, but still some mixed-content issues:

"Loading mixed (insecure) display content “http://image.ibb.co/cbnnKG/thinking4.png” on a secure page"

It seems as if the emote isn't hosted on MC-Market, but otherwise on IBB (which does support SSL, by the way). It'd probably be better to move that emote and (https://static-cdn.jtvnw.net/emoticons/v1/25/1.0) to MC-Market's server and use MC-Market related links, rather then depending on a third party.

That's the only SSL issue I've found, and it's such a simple fix to have MC-Market fully SSL enabled.

Worth mentioning that it isn't possible to embed externally hosted images. They disabled it for 'security reasons'.

 

[Landon]

Worth mentioning that it isn't possible to embed externally hosted images. They disabled it for 'security reasons'.

Four months after Mick said ‘two days’ for the fix.

 

[Jay]

It's actually quite funny tho because if you just use chrome dev tools to see which images are served over HTTP and click on them. They automatically redirect to the https link.

http://image.ibb.co/cbnnKG/thinking4.png <-- is a link used from mcm but the actual source is over https, not sure why they don't just update the links..

https://image.ibb.co/cbnnKG/thinking4.png <-- link they should be using

A workaround I guess to give you that sweet "Secure" lock in url is to use the extension HTTPS everywhere https://chrome.google.com/webstore/...cbommkclmclpchllfjekcdonpmejbdp/related?hl=en

And enable "Encrypt All Sites Eligible" in the settings. It will make MCM "secure" on the url bar

 

[Ajdin]

It's actually quite funny tho because if you just use chrome dev tools to see which images are served over HTTP and click on them. They automatically redirect to the https link.

The browser doesn't touch the resource at all if it isn't https meaning it will not read the redirect.

The fact people have to suggest browser extensions to have a fully functional browsing experience is pretty funny.

 

[Jay]

no what I mean is, the content source already supports https. so it shouldn't even require a proxy on MCM's side. literally, just update the link and it'll be fine. (replace http with https)

TLDR: I agree with you that MCM should fully transfer all content over encrypted connection

 

[Landon]

no what I mean is, the content source already supports https. so it shouldn't even require a proxy on MCM's side. literally, just update the link and it'll be fine. (replace http with https)

TLDR: I agree with you that MCM should fully transfer all content over encrypted connection

It’s a simple solution, yeah, but still better for them to move the emotes to their own server. And then to implement the proxy for user security, so IP addresses of anyone who views an image isn’t logged.

 

[Zyger]

no what I mean is, the content source already supports https. so it shouldn't even require a proxy on MCM's side. literally, just update the link and it'll be fine. (replace http with https)

TLDR: I agree with you that MCM should fully transfer all content over encrypted connection

But that would take too much work ):

 

[Claxxed]

I think they should get an EV SSL Certificate.

 

[Landon]

I think they should get an EV SSL Certificate.

The certificate doesn’t matter. It’s a matter of configuring the resources the site uses to fully implement SSL protection.

 

[Claxxed]

Imo, everyone buys SSL more for the looks than anything lol

 

[Landon]

Imo, everyone buys SSL more for the looks than anything lol

No, it’s 2019, secure transfer of web content should be a norm. Non-SSL affects SEO negatively, and businesses want high rankings, not low.