Why doesn't BlackHatWorld use https?

L

LaidbackLad

Newbie
Joined
Apr 3, 2016
Messages
13
Reaction score
18
So I was wondering, BlackHatWorld is such a big reputed site with lots of visitors sharing their personal information. Why not use https to secure the communication two ways? I know it has a little overhead in terms of performance. But shouldn't users' security be favored more than performance? Or are there any plans of using https later in future?
 
Advertise on BHW
Reputation is build with time. You generally don't consider SSL encryption any significant at early days, especially for a forum. Well, after building reputation, it is one heck of a task to move a site from Http to Https.

I think they might have given it a thought for a new release now, which might come out pretty soon.. :)
You got to wait & see!
 
LaidbackLad said:
So I was wondering, BlackHatWorld is such a big reputed site with lots of visitors sharing their personal information. Why not use https to secure the communication two ways? I know it has a little overhead in terms of performance. But shouldn't users' security be favored more than performance? Or are there any plans of using https later in future?
Click to expand...

What 'personal information' do you think users are sharing that needs to be secure? I think it's OTT to use https to protect a users password and email address - or am I missing something? It's more often used for sensitive information which could be used to identify that individual or commit fraud - I'm thinking address and/or credit card details.
 
kickthat said:
What 'personal information' do you think users are sharing that needs to be secure? I think it's OTT to use https to protect a users password and email address - or am I missing something? It's more often used for sensitive information which could be used to identify that individual or commit fraud - I'm thinking address and/or credit card details.
Click to expand...

Private Skype details are shared here but however it's only visible for registered members :)
So, not much of personal stuff but it's always good to be cautions of malware and other attacks..
 
Vbulletin just announced they have moved all their Cloud customers to https that may be the reason for why OP is asking. The idea to protect a forum with SSL is good and should be considered I think.
 
kickthat said:
What 'personal information' do you think users are sharing that needs to be secure? I think it's OTT to use https to protect a users password and email address - or am I missing something? It's more often used for sensitive information which could be used to identify that individual or commit fraud - I'm thinking address and/or credit card details.
Click to expand...

Maybe you're right. We don't share sensitive information here. But still, the site is susceptible to Man in the Middle attacks. They might not get much with our username and password. But what if the user has used the same username/password combo in many sites? One might think the password contains only dots or stars, but it's just on the client side. When you submit the form and the request is intercepted, the attacker might get access to the username/password combo. VBulletin may hash the passwords on the client side with JavaScript, but what if the user has JavaScripting disabled?
 
Last edited:
RuthSam said:
Vbulletin just announced they have moved all their Cloud customers to https that may be the reason for why OP is asking. The idea to protect a forum with SSL is good and should be considered I think.
Click to expand...

Nah. I don't know about that. I'm learning about web development right now. Web apps security is a very important issue to address. I just happened to notice it just because I've been dealing with http, https, signing, salting, hashing, TLS handshake all day long.
 
Last edited:
 
Last edited:
LaidbackLad said:
Damn. I'm getting paranoid right now. Lol.
Click to expand...

Don't be. Clearly these people haven't been on the forum very much, or they would know that hacking is not something we associate ourselves with here.
 
JustUs said:
I think the OP does not know that HTTPS (SSL) is pretty much irretrievably broken. The OP may also not know that HTTPS gives users a false sense of security.

https://www.google.com/search?q=htt...&ie=utf-8&oe=utf-8#q=ssl+irretrievably+broken

If a Google search is not good enough, here is a 2011 article from the register:
http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/
Click to expand...

You don't even have to hack, there are tons of SSL interceptors available in the market that can seamlessly decrypt the data.
 
JustUs and grazy:

True. I didn't really know about this. So unless you're a hacker yourself there's no such thing as security in the interwebs?
 
qrazy said:
You don't even have to hack, there are tons of SSL interceptors available in the market that can seamlessly decrypt the data.
Click to expand...

You can't get plaintext traffic out of SSL unless:

a) You have a 0-day crypto attack on the underlying encryption scheme (you don't)
b) You have a means of generating a trusted certificate (you don't)

That's it. What you are thinking of works by "downgrading" to HTTP. That assumes that a) the target site uses http as well as https and b) the user will not notice the padlock missing
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top