Orpington Astronomical Society

Back Room => Updates and Upsets => Topic started by: MarkS on Jul 25, 2018, 12:13:16

Title: OAS website is "Not Secure"
Post by: MarkS on Jul 25, 2018, 12:13:16
My recently updated Chrome browser (version 68) now warns me in the address bar that the OAS website and forum is "Not Secure".

I think that means OAS is not using HTTPS, the secure and encrypted version of HTTP.  So it is plaintext pages that are sent from the OAS server to my computer (potentially hackable en route) rather than encrypted pages which need to be unencrypted on arriving at my PC.

I don't think it's anything to worry about though.  Or is it?

Mark
Title: Re: OAS website is "Not Secure"
Post by: The Thing on Jul 25, 2018, 19:45:06
If I was banking on it I'd be worried. As long as the domain isn't hijacked for nefarious purposes such as discussing odd pursuits carried out in the dead of night and with subsequent picture sharing amongst a group of 'like minded' individuals...
Title: Re: OAS website is "Not Secure"
Post by: ApophisAstros on Jul 26, 2018, 15:11:56
Quote from: The Thing on Jul 25, 2018, 19:45:06
If I was banking on it I'd be worried. As long as the domain isn't hijacked for nefarious purposes such as discussing odd pursuits carried out in the dead of night and with subsequent picture sharing amongst a group of 'like minded' individuals...
LOL :lol: :lol: :lol:
Roger
Title: Re: OAS website is "Not Secure"
Post by: Rick on Jul 26, 2018, 15:43:56
Google seems to want to push use of HTTPS everywhere, but assuming you don't use the same password for O.A.S. sites as you use for your bank or on-liine shopping accounts, I don't see any problem at all with staying on HTTP.

...and going to HTTPS is very likely to involve extra costs, as you need a certificate signed by one or other of the "trusted" authorities, and you probably also need an individual static IP address for each site. For a business, that's probably not a problem...

(I looked into the issue last year, and figured at that point that doing the necessary re-structuring so as to have everything in a single site so that we only needed one certificate would still mean paying at least double the present hosting costs for HTTPS.)