The LTB Network Forum


https

Back to LTB Platform Development & Support

Jump to bottom
Pages: 123

Comments

  • IvanB

    @cryptonaut I'm glad that you're implementing HTTPS and change email verification or notifications soon. Granted that no one can steal your wallet, however, it would be unfortunate if a MitM attack were to harvest passwords and then change a ton of LTB addresses right before an expected distribution were to take place. There's no CTRL-Z for that situation.

    No, SSL isn't the end of security and eventually decentralized is the way to go but plaintext is never going to be the best way to get there. :)

    My recommendation is a Comodo SSL cert through a reseller like Namecheap. A basic cert will cost you around $10/year and it's much better than the free cert options. https://www.namecheap.com/security/ssl-certificates/comodo.aspx

    Permalink
    0 likes
  • Cryptonaut

    @lainfinity @cryptonaut If you are planning to implement HTTPS in future have a look at CAcert.

    They are community based who provide root certificate and server certificates.

    Thanks for the link!

    Permalink
    0 likes
  • bitsol

    @gthrones Adam, Could you add HTTPS to letstalkbitcoin please?I think every website in the bitcoin space should use HTTPS and set the standard. It is not just about protecting personal content, though users may want their comments and interactions to be private, but it is also for security. Any site that uses javascript sent over an unsecure http connection creates a vulnerabilty potential for a user due to potential for a MITM or backbone rewriting attack. Especially, in this space of digital currencies, smart users will stop using javascript on any page that is not https to improve their overall security.A cert is cheap and can even be bought with bitcoin on namecheap I think.You can help set this as a standard in the bitcoin community.

    I agree!

    Permalink
    0 likes
  • Emerger

    Glad to find this topic already as I was surprised there was no https, especially on the account login.

    Permalink
    0 likes
  • JayeK

    If anything https will allow me a way around my workplace firewall, so if even for that, please?

    Permalink
    0 likes
  • Cryptonaut

    @jayek If anything https will allow me a way around my workplace firewall, so if even for that, please?

    how would it get around the firewall at your workplace?

    Permalink
    1 like
  • mdw

    Using HTTPS means people between you and the server cannot see the contents being sent back and forth, it is encrypted. It does not prevent man-in-the-middle attacks. It does not protect anyone from rogue javascript or help you bypass firewalls.

    It does offer slightly better protection from snooping parties. Hate to say it but the benefits are slight in this case. Not very useful to waste your money supporting a broken X.509 certificate system.

    I would be delighted to assist with setting up a backup of this site on a .BIT domain. @adam is this domain yours? We can plan for a .p2p one as well if BitsharesDNS ever puts out their offering.

    I posted an article yesterday that's now being edited introducing this very topic. I am writing more even now. Tune in to read more about the political and technical issues around privacy, identity, security and censorship on the Internet today, and how blockchain technology can alleviate or solve many of the main issues.

    Permalink
    0 likes
  • Cryptonaut

    @mdw Using HTTPS means people between you and the server cannot see the contents being sent back and forth, it is encrypted. It does not prevent man-in-the-middle attacks.

    It does offer slightly better protection from snooping parties, but you still must trust in a very untrustworthy system - digital certificates & CAs. Hate to say it but the benefits are slight in this case. Not very useful to waste your money supporting a broken X.509 certificate system.

    I would be delighted to assist with setting up a backup of this site on a .BIT domain. @adam is this domain yours? We can plan for a .p2p one as well if BitsharesDNS ever puts out their offering.

    I posted an article yesterday that's now being edited introducing this very topic. I am writing more even now. Tune in to read more about the political and technical issues around privacy, identity, security and censorship on the Internet today, and how blockchain technology can alleviate or solve many of the main issues.

    The certificate authority system might be broken.. assuming your also trying to keep totally private from the government and powerful corporations. HTTPS still protects you for the vast majority of use cases though (i.e, most hackers and script kiddies). Encrypting the data over the wire is vastly better then sending it all plaintext..

    .bit and similar domain systems would be great, but it would be kind of pointless at this stage since 99% of people that come to the site will have no idea about it or no way to even access it (your browser cant natively read info for .bit)

    Permalink
    0 likes
  • mdw

    @cryptonatu agree, that's why I suggested .bit as a backup only, we would lose most viewers by abandoning the .com in favor of ONLY .bit at this time.

    Don't really agree about the degree to which HTTPS protects against hackers though. It is somewhat better protection, since it's all encrypted. I just cringe a bit when people equate HTTPS with being secure against malicious javascript or people trying to steal passwords or hijack sessions or MITM attacks, etc. All demonstrably untrue.

    Permalink
    0 likes
  • Cryptonaut

    @mdw @cryptonatu agree, that's why I suggested .bit as a backup only, we would lose most viewers by abandoning the .com in favor of ONLY .bit at this time.

    Don't really agree about the degree to which HTTPS protects against hackers though. It is somewhat better protection, since it's all encrypted. I just cringe a bit when people equate HTTPS with being secure against malicious javascript or people trying to steal passwords or hijack sessions or MITM attacks, etc. All demonstrably untrue.

    How so? From what I understand you would basically need to spoof yourself as the certificate authority, which you need to be physically close to your target in order to even attempt right?

    Permalink
    0 likes
Jump to top
Pages: 123

Post Reply

Please Login to post a reply to this thread.

© Copyright 2013–2016 The LTB Network. All rights reserved .