Source
r/radicalheights•
techtox

Official forums don't use HTTPS. Be careful with your login info.

Website seems very rushed. No HTTPS, some of the links don't match the actual content. Your login info (email, username & password) is being sent over the internet unencrypted. And I wonder how they're storing that info on their servers. Hopefully not plain text. I already reported it on the forums but developers havent replied, though they have replied to newer posts.

Posted Apr 11, 2018, 11:48 PM UTC

96
MarshalMazda•

That's really disappointing, HTTPS is a must have for anything dealing with sensitive info.
I hope BossKey can get that setup ASAP

3
techtoxOP•

They should've had it already. I registered with an email i don't care about and a username + password that i only use for this website. Problem is that people don't know why it's important and sometimes don't even catch the fact that it doesn't have HTTPS. I just happened to see it before registering.

1
fuckthekids•

That's honestly nuts. SSL certs are so trivial and cheap to set up these days.

1
techtoxOP•

There's even free certificates, but you just have to renew them more often (every 3 months).

1
anyok6•

AWS offers them for free, 1 year renewal.

1
techtoxOP•

Looks like their main website, radicalheights.com, uses a free cert from let's encrypt. Yet they didn't implement it where it's really needed, on their forums. What a joke.

1