Implement SSL properly

[Ajdin]

Hello,

First of all, great that MCM implemented SSL. It surely is a positive step towards improving security on this website.

The SSL implementation isn't completely done right though.

For a whole website to be safely encrypted, all traffic on it needs to be SSL. This isn't the case on MC-Market.

Anyone can post an image that's just the good old "http" instead of "https". This has 2 massive downsides.

1. Most browsers will not load the content (in this case images)
2. Affects ranking in Google/Other search engines significantly. Webpages with 'http' sources are essentially considered unsafe.

I'd actually be more scared of the 2nd than the first. Google is trying to crack down heavily on insecure webpages. Since there's no exact number on how heavy this weighs on Google for a website, I can't give accurate numbers but I can imagine it is quite heavy on your Google ranking.

There's actually plenty of tutorials on how to implement SSL on XenForo properly. However, it's pretty simple:
Enabling SSL for a webserver is not hard. You purchase and install a certificate, restart your webserver, change some XenForo settings and tadaa.

There's a big part that MCM missed though. They need a reverse proxy to route traffic for all non "https". I'll use Spigot as an example:
Spigot routes all external traffic through their reverse proxy, http and https. This has a positive influence on loading speed due 2 reasons. The browser that visits the website only needs to go to 1 webserver which is Spigot's.

Go to this post as an example: https://www.spigotmc.org/threads/best-way-to-promote-my-minecraft-server.306955/
Right click on any image and copy the URL. You'll see it starts with "https://proxy.spigotmc.org/". This means, whatever kind of image you post on Spigot, it'll be routed through there. The proxy caches the image for quicker speeds. Additionally, it obviously makes the URL a https URL which is what MCM needs at this time.

With current's implementation, sure all login information is encrypted and such but I don't think visitors should have their browsers blocked from seeing regular http images.
Go ahead and visit a few threads, open your webconsole (CTRL + SHIFT + I), click on console and you'll probably see a bunch of errors like these:

I'm hoping to see this fixed.

For the noobies TL DR:
Fix this

 

[Harry]

The browser doesn't touch the resource at all if it isn't https meaning it will not read the redirect.

The fact people have to suggest browser extensions to have a fully functional browsing experience is pretty funny.

That's just not true though... Clearly, you can see the image does actually load, and this is because it does actually follow the SSL redirection to load the image over HTTPS (you can see this by going into the Network tab of the developer tools).

It's just a warning, and in this case, it doesn't really mean much because it is actually being loaded over HTTPS.

https://gyazo.com/41f4858f255c85df1101647b3e5ef3bf[DOUBLEPOST=1550742080][/DOUBLEPOST]Ajdin Back on the subject of the image proxy quickly, considering you never actually replied to my DM.

As you've already mentioned, GDPR does consider an IP address as "personal data" and so, to be compliant, it has to be treated in that way. So, even though I think it is a security issue in itself to allow anyone to track other users, it's also a legal issue.

 

[Ajdin]

hat's just not true though... Clearly, you can see the image does actually load, and this is because it does actually follow the SSL redirection to load the image over HTTPS (you can see this by going into the Network tab of the developer tools).

It's just a warning, and in this case, it doesn't really mean much because it is actually being loaded over HTTPS.

https://gyazo.com/41f4858f255c85df1101647b3e5ef3bf

I actually have mixed content completely disabled, hence why I don't see it. This is a client sided thing so it can be different for everyone depending on their browser settings.

Ajdin Back on the subject of the image proxy quickly, considering you never actually replied to my DM.

As you've already mentioned, GDPR does consider an IP address as "personal data" and so, to be compliant, it has to be treated in that way. So, even though I think it is a security issue in itself to allow anyone to track other users, it's also a legal issue.

I didn't respond for a reason. I had no interest in continuing this discussion. - I still don't.

 

[Harry]

I actually have mixed content completely disabled, hence why I don't see it. This is a client sided thing so it can be different for everyone depending on their browser settings.


I didn't respond for a reason. I had no interest in continuing this discussion. - I still don't.

Well, that's a choice, and I believe pretty much everyone has it enabled, by default as well.

Well, could have simply stated you no longer wanted to continue, instead of ignoring the DM. Would've been appreciated, but I hope now you see why they took action because clearly, they see it as a security and/or legal issue as well.

 

[Ajdin]

Would've been appreciated, but I hope now you see why they took action because clearly, they see it as a security and/or legal issue as well.

Ok you should try doing the same to all other (larger) forums who won't take action. Why? Because they are not as clueless and impulsive decision makers as the people on MCM.

You made it a big deal while it shouldn't be.

 

[Harry]

Ok you should try doing the same to all other (larger) forums who won't take action. Why? Because they are not as clueless and impulsive decision makers as the people on MCM.

You made it a big deal while it shouldn't be.

I have no clue why they don't proxy their images, but I've contacted them to find out.

Back to my original point though. Why don't you let me place an image on your site so I'm able to track your users if it's not a security or legal issue at all?[DOUBLEPOST=1550750122][/DOUBLEPOST]I must add, the Privacy Policy specifically states:

Your IP address is not visible to the public at any time.

It also withdraws liability when clicking on external links, where's these images are being loaded, without the user consenting to it beforehand, so these are two different situations.

 

[Jayson]

Smilie SSL was repaired previously. Please let us know if you encounter any additional errors in regards to this.

 

[Mick]

As Jayson has said the problems raised in this suggestion have now all been addressed, and SSL should be implemented perfectly how it is.

Thanks for the suggestion, I'll move this to accepted.