Printable View
I'm a huge fan and support of continuous encryption-based security while doing anything on the internet, and am curious as to if AO has ssl https capability? I tried https already directly in the url and it failed, so I'm assuming it doesn't have it.
Is there any possibility of having ssl for AO and giving users the option of browsing that way?
AFAIK, The only reason we should have the SSL is for logging in. Other than that, anything you post is going to be viewable by the world, so why bother? I'm not sure what else you would use SSL for....?
-ik
[edit]To clarify, If what I'm saying is indeed true (I've been proven false many times before), I don't think it would be worth the hassle for admins to instate SSL, obtain security certificates, etc just for logging in.[/edit]
Man in the middle attack that reads the plaintext being sent between me and the AO server, catches it, alters it, continues transmission to origonal destination with the modified content. Also for when I sent private messages to other members, it can't be caught in midair when I go wireless.Quote:
I'm not sure what else you would use SSL for....?
I'm not paranoid, just enjoy making sure I know where my information is going.
Both of you have valid points...I think it comes down to Jupiter Media not having the resources to invest extra time and money into getting a cert and instituting HTTP/S. It's not really *hard* to do...it's more an issue of the cost to plan it, set it up in test, test it, set it up in production, move it to production, build support, etc.
It's not like it's a huge enterprise rollout for them, but it *is* more than getting a cert issued and change a few flags in some conf file. That takes time from your engineers/admins to set up and do, or you have to pay someone else to come do it for you. Most IT departments are *still* under staffed and budgeted, so it's likely just not a priority.
I understand, and now that I see your point of view I agree in this case. JM may be well understaffed, and something as trivial as using SSL capability for those few users who would take advantage of it would not be worth the cost/manpower.
yeah, Ive had to setup SSL via Apache on a few servers. Only one company actually went and bought the Certificates, the others just trusted the server which made me the certificate.
Its not too hard at all, and I do feel alot more comfortable when im searching security sites in SSL. Im not doing anything illegal, but I would have much more comfort knowing my ISP doesnt have too much of an idea what Im doing...