Website Security http://communitytranslation.freeforums.net

My computer never alerted me to that; quizzical. If it's possible, we can see what we can do. Ultimately, that might be beyond us and be within Proboards itself.

I'm afraid that security around http and https and how browsers deal with them keeps changing quite fast these days and the situation is quite confusing. So everyone's experience might be different based on operating systems, browsers and their versions (most likely the newer the version of the browser, the more likely it is to complain).

I'm not an expert though, I just have people around me who know more about it than I do.

Ok, I did some research and Proboards uses https for log in and registration. They are in the process of turning all pages to https this year. Most websites use https for pages that are transmitting information requiring security, so Proboards is pretty standard in that area. I'm not sure why you got an http page when logging in, since that is not in accordance with normal Proboards procedures. Sassicat

Good questions Sassicat .  I was going to respond to all your questions, but JoThelan has given you the facts about ProBoards.

HTTPS implements an encrypted channel of communication between your client browser (Chrome/Firefox/IE/whatever) and the website server (freeformums.net).  In less technical terms, all the data is made to look like garbage, as it is transmitted across the internet.  Only the server can initiate such a connection, because it holds the private encryption key, necessary to decode the data you send.  You cannot force it from your end.

Encryption is particularly important to mask passwords, which is why ProBoards has to use HTTPS for registration and sign on, otherwise anyone could capture your password, impersonate you and have access to all your information, even when it is not being transmitted. For any commercial activity it is also important to mask payment details in transit: credit cards, bank accounts, etc. Hence you should always look for the padlock icon before entering any such information on a merchant's webpage, although that is not the case here, as no money changes hands.

So you are correct, your email address is vulnerable on Communitytranslation.  Although we have given details elsewhere (Email security) of how not to reveal your email address to other forum Members, the moderators can still see it, and if I was looking at your profile now, your email address would be transmitted in clear over the internet and could be seen by anyone with the necessary hardware/software.

If you are using SmartCAT, your email address can be seen by the admin(s) there too, although SmartCAT uses HTTPS throughout.

But for anyone concerned about email address security, the key is to treat all email addresses as disposable.  You cannot trust anyone to keep your email address secure, from friends whose address books get hacked, to large corporations.  I regularly receive loads of spam sent to the unique mail addresses I have set up for BMW, Toyota, Groupon ... and probably TalkTalk too, if I was a customer of their's.  Actually, getting all this spam is great for security, because when I see the same email come in for more than one address, I know that it is fraudulent and can delete it without even opening it.

In fact, I have got a block of disposable email addresses set up especially for the moderators of this site - if any of you want one, just PM me.

To recap on an important security message: HTTPS only helps to protect data in transit.  It does not mean your data is secure when it reaches the website.  And frankly, I wouldn't trust my data on any free website (ProBoards, DuoLingo, Facebook ...), whether they use HTTPS or not.  The fact is that you have no contract with the providers of the said websites, so you have no financial sanction over them for any damage they may cause you, other than the general duty of care they owe to any member of the public.


 

Skeptical?  A snippet from the HTTPSEverywhere FAQ: 

"HTTPSEverywhere depends entirely on the security features of the individual web sites that you use; it activates those security features, but it can't create them if they don't already exist. If you use a site not supported by HTTPS Everywhere or a site that provides some information in an insecure way, HTTPS Everywhere can't provide additional protection for your use of that site."

This is basically the same message as you quoted me as saying above, just more specific to what HTTPSEverywhere can and cannot do.

All that HTTPSEverywhere does is ensure that, where a website offers both http:// and https:// servers, the connection is made over the https:// link rather than accidentally picking up the unencrypted service.  Since ProBoards does not yet offer an HTTPS connection for most parts of this website, it is not going to enhance anyone's security by using it.

(At least I hope that is correct.  I am not an industry expert in internet protocols, nor am I familiar with these add-on tools and plug-ins, mainly because I think they are about as effective as wearing garlic to ward off vampires and I wouldn't let them near my computer.)

Hi everyone

Thanks again for all your help, information and excellent explanations.

Just to update I've found out why my friend can't sign into Community Translation. I saw him today and because his grandchildren often use his computer, his internet provider account is set up so that it can't access any social media, or forums. So that explains that!

Ciao e grazie