The LTB Network Forum

https

Back to LTB Platform Development & Support

Comments

gthrones

Offline
Posts: 10

Adam, Could you add HTTPS to letstalkbitcoin please?

I think every website in the bitcoin space should use HTTPS and set the standard. It is not just about protecting personal content, though users may want their comments and interactions to be private, but it is also for security. Any site that uses javascript sent over an unsecure http connection creates a vulnerabilty potential for a user due to potential for a MITM or backbone rewriting attack. Especially, in this space of digital currencies, smart users will stop using javascript on any page that is not https to improve their overall security.

A cert is cheap and can even be bought with bitcoin on namecheap I think.

You can help set this as a standard in the bitcoin community.

Posted on March 19, 2014 at 10:41 PM
Last Edited: July 19, 2014 at 7:09 AM

3 likes

• adam

  

  Offline
  Posts: 1980
  Location: California, USA

  The current website is static, the new website rolls out soon and I will make a note of this.

  Posted on March 20, 2014 at 5:07 AM
  Last Edited: July 19, 2014 at 7:09 AM
  Permalink
  0 likes
• fastfinge

  

  Offline
  Posts: 30

  I kind of disagree with this. HTTPS gives a false sense of security, especially for things like LTB. If you are concerned that your device or computer is not secure, the attackers have probably already installed a new certificate authority, so even if LTB got a signed cert, they could launch a man in the middle attack without your browser even prompting you. If someone else has any access to your computer, it is extremely easy to intercept, modify and monitor all of your HTTPS connections, without your browser warning you. With things like Namecoins and Free Speech Me, I am absolutely convinced that the crypto currency community can do a much, much better job at creating decentralized security, and replacing the centralized, broken certificate authority model we have now. So let's not encourage people to think that HTTPS is good enough, or that they're secure just because some random address begins with HTTPS instead of HTTP. The LTB Network seems to be at the forefront of adopting new and better technology, and raising awareness of how and why centralized systems are broken. This entire network is filled to the brim with extremely smart people, and I know that we can do better than HTTPS. I wish that I was smarter, and could help out more directly with this effort, though.

  Posted on March 20, 2014 at 2:19 PM
  Last Edited: July 19, 2014 at 7:09 AM
  Permalink
  2 likes
• jamiebeach

  

  Offline
  Posts: 8

  fastfinge said: I kind of disagree with this. HTTPS gives a false sense of security, especially for things like LTB. If you are concerned that your device or computer is not secure, the attackers have probably already installed a new certificate authority, so even if LTB got a signed cert, they could launch a man in the middle attack without your browser even prompting you. If someone else has any access to your computer, it is extremely easy to intercept, modify and monitor all of your HTTPS connections, without your browser warning you. With things like Namecoins and Free Speech Me, I am absolutely convinced that the crypto currency community can do a much, much better job at creating decentralized security, and replacing the centralized, broken certificate authority model we have now. So let's not encourage people to think that HTTPS is good enough, or that they're secure just because some random address begins with HTTPS instead of HTTP. The LTB Network seems to be at the forefront of adopting new and better technology, and raising awareness of how and why centralized systems are broken. This entire network is filled to the brim with extremely smart people, and I know that we can do better than HTTPS. I wish that I was smarter, and could help out more directly with this effort, though.

  Certainly https > http.  It's also a web browser standard.  Anything else, even a simple browser plugin could introduce a barrier to entry and potentially alienate a significant part of the community.  For the time being anyway.  Namecoin definitely has a lot of potential (even ICANN apparently thinks so), but I'd be cautious of using it exclusively for any website until it (or something similar) is more broadly adopted.

  Posted on March 20, 2014 at 2:54 PM
  Last Edited: July 19, 2014 at 7:12 AM
  Permalink
  0 likes
• fastfinge

  

  Offline
  Posts: 30

  jamiebeach said: Certainly https > http.  It's also a web browser standard.  Anything else, even a simple browser plugin could introduce a barrier to entry and potentially alienate a significant part of the community.  For the time being anyway.  Namecoin definitely has a lot of potential (even ICANN apparently thinks so), but I'd be cautious of using it exclusively for any website until it (or something similar) is more broadly adopted.

  I'm not saying use Namecoin or some plugin based system exclusively, and I do agree that HTTPS is a little bit better than HTTP. But I think people wildly overestimate just how much better it really is. If it were entirely up to me, though obviously it isn't, I would offer the regular HTTP website, with a big message at the top encouraging people who are concerned about security to use .bit or whatever plugin is/becomes the best at decentralized security, and not offer standard HTTPS at all. But I'm fully aware this isn't likely to happen. I'm just pushing this wildly idealistic solution to prompt thought and discussion, and because I'm slightly bitter about having to pay high prices for signed certificates that are nearly entirely meaningless, just to make a lock icon appear for users. On another related note, letstalkbitcoin.bit doesn't seem to exist?

  Posted on March 20, 2014 at 3:15 PM
  Last Edited: July 19, 2014 at 7:13 AM
  Permalink
  0 likes
• adam

  

  Offline
  Posts: 1980
  Location: California, USA

  So how about an obviously unsecure site that is advertised as such "SSL IS NOT BEING USED, SOMEONE COULD BE MONITORING YOU" with a link to our .bit or .coin distributed domain?
  Frankly, I want to move onto decentralized internet techs like Maidsafe ASAP

  Posted on March 20, 2014 at 6:51 PM
  Permalink
  3 likes
• fastfinge

  

  Offline
  Posts: 30

  Adam said: So how about an obviously unsecure site that is advertised as such "SSL IS NOT BEING USED, SOMEONE COULD BE MONITORING YOU" with a link to our .bit or .coin distributed domain?

  Frankly, I want to move onto decentralized internet techs like Maidsafe ASAP

  Yeah, this is exactly what I was thinking of.

  Posted on March 20, 2014 at 10:26 PM
  Last Edited: July 19, 2014 at 7:11 AM
  Permalink
  0 likes
• Kevlar

  

  Offline
  Posts: 20

  Isn't HTTPS still a good idea even when visiting .bit sites? An attacker can't spoof/redirect a .bit site as easily, but they could still intercept your traffic and see what you're doing over it, which HTTPS would guard against.
  

  Posted on April 1, 2014 at 3:10 PM
  Permalink
  0 likes
• Rob

  

  Offline
  Posts: 604
  Location: California

  @Adam @Cryptonaut

  I just updated my settings to turn on the new feature, "Receive occasional free tokens to my Counterparty compatible address" (I wonder if this setting should be hyped more to users in a general notice to all? I felt lucky to see the thread that mentioned it). I was asked to enter my password again to checkmark this option, which is a good security feature for changing any user settings. But then I realized the password was sent in the clear. Like others in this thread, I think it makes sense to add HTTPS/SSL to the site. People are getting really involved on the forum, gaining trust/reputation, and doing more trading (sometimes for physical goods, so trust is required). Not to mention, simply changing the LTBc address could cause a problem. Obviously, nothing is perfect, but encrypted communication of our passwords is surely better than sending passwords in the clear.

  As another security step (now that I'm thinking about it), notification emails should be sent any time important settings are changed. We get emails saying every time someone liked one of our posts, so seems reasonable to send an email any time user settings have been changed. If it's important enough to require a password to make the change, it's important enough to send us a notification email (sometimes such emails are the way we discover we've been hacked -- had PayPal has a notification feature, Paul Boyer would have realized immediately when someone entered a payout address in his PayPal settings).

  And this minor rambling has me thinking, should there be more attention paid to security on the site? With so much crowdsourcing for content, etc., should we be crowdsourcing to make the site and forum as secure as possible? Seeing so many hacks in the crypto-space, seems it would be wise to be as secure as possible, as early as possible.

  Posted on July 19, 2014 at 7:06 AM
  Permalink
  0 likes
• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  @Rob , for the notifications - noted. I agree password protected account settings should also give you an email.

  getting HTTPS set up is on our list to do fairly soon. In regards to some of the earlier comments in this thread, as a web developer, HTTPS is most definitely far far better than regular HTTP. It's not perfect, and you still have to trust the certificate authorities, but it is much better than just sending everything over the web un-encrypted.

  We also are purposely not holding any bitcoin wallets etc. on the website, so our security risk is actually pretty low. Pretty much the only actual sensitive information we are holding (currently) is password hashes for peoples accounts, but even if someone got a hold of that it would be pretty much useless.

  Posted on July 19, 2014 at 7:27 AM
  Permalink
  1 like
• lainfinity

  

  Offline
  Posts: 76
  Location: Multiverse

  @cryptonaut If you are planning to implement HTTPS in future have a look at CAcert.

  They are community based who provide root certificate and server certificates.

  Posted on July 21, 2014 at 7:53 AM
  Permalink
  0 likes

Post Reply