Got a response about the HTTPS situation.
This is their response: https://imgur.com/a/N33UE Can't even use their website using https.
Posted Apr 12, 2018, 5:51 PM UTC
48
Well that is a fairly poor bit of community management on their part. Banning you for 2 weeks for pointing out that their website is insecure AND being dismissive of your completely valid concern about https? Not a good look, Bosskey.
Attempting to use the forums via https just returns a 403 error. Honestly it's just lazy (not to mention super bad practice) to not be using HTTPS in the first place... and it's also simple to fix for any competent webdev. Depending on their stack it might require a bit of htaccess/redirection work to make the transition correctly but there is literally no excuse to not be using HTTPS in 2018, especially on a forum where you are hosting user data.
1
People just think I'm trying to attack them. Thank you for understanding. They did follow up though, with a slightly better response (https://imgur.com/a/zmrgS). Why slightly? Because I have a feeling it's about their proposal of manually entering HTTPS and that it's not working. I'm going to keep an eye on this.
Their other forums, that have been around for longer, also don't have HTTPS. People said "give them time", but I think they've had plenty of time for their other forums, so I don't have a lot of hope.
1
Isnt there an extension called something like HTTPS everything. I agree with you though, shit is not professional at all.
1
I was waiting for someone to bring this up. Yes there is "https everywhere". But almost nobody uses it. It's up to the website to implement it, not the user. HTTPS is also used to validate the server, to make sure you're actually exchanging info with the right server. HTTPS everywhere does, and cannot provide that.
1
I understand, I was just listing an option for people if they do want to continue to use their forums. It's a very easy thing for them to fix, there has to be a reason why they don't... probably just incompetence.
1
Good news. They just implemented it.
1
Great, I thought they were gonna end up doing it the hard way (after someone stole the info and used it)
1
I've also checked if their other forums had HTTPS. They don't. The bosskey forums don't have it. Their lawbreakers forums don't have it. And those have been around for quite a while longer is my guess.