HTTPS for this forum


#1

It would very good for this forum to be served through https. Considering Airtel’s new capabilities to mess with http streams, I would consider it a major security issue. Also, recent site take downs by the Department of Telecommunications are http stream level, and are no longer based on DNS redirecting. And, of course, there are a hundred more reasons why https is good. I’m pretty sure you are already aware of all that. So, I won’t elaborate on that.

startssl provides free (gratis) certificates. They could be an option. Let’s Encrypt is coming soon, but it’s not ready yet, I think. Please consider, and make haste. This is quite important.


#2

Let’s Encrypt looks very legit and good. We can probably wait for it.


#3

http for this forum also means that during login and new user registration, passwords are transmitted in plain text? I hope there is at least some hashing being done.


#4

Discourse is a freesoftware, you can check it’s source code and find it. I am sure it is well made, it is lead by some of the smartest people in the planet.


#5

Let’s Encrypt says it’ll be ready for general use on September 14, 2015.

I hope so too.


#6

A similar discussion in another discourse powered forum…

http://discourse.stonehearth.net/t/discourse-not-using-https/9722


#7

@aravinthk please check here, and see what can be done.


#8

I’ll look into it and let you know soon


#9

Yup https would be great. It would work well on Ice cat browser which I use.


#10

Hi @arunisaac, I have been following Let’s Encrypt like 6 months and was waiting for them to go public. The reason why we were not able to install SSL Certificates was not a technical difficulty, rather it’s a finanical difficulty (There are gratis services like startssl, but when I saw Let’s Encrypt, We thought we can wait). I have always wanted to ensure all the online platform from FSFTN to use HTTPS by default, as a community organization funding plays a major role.

Thanks for reminding again. My suggestion would be to wait and proceed with Let’s Encrypt.


#11

3 months more for Let’s Encrypt to be ready. A little bit of a long wait for me. But, yes, let’s wait. Hopefully, they will be on schedule and deliver. So far, they seem to have done well. We’ll see.


#12

I think it’s stupid to wait when it comes to security. Let’s get a TLS certificate up and running from StartSSL. Gratis certificates for now. @aravindgd, let’s get started and do what needs to be done.


#13

Would appreciate help. I am caught up with some work right now. I cannot do this rightaway. @aravinthk or @yogesh. Can you guys help?


#14

Yea, Okay. Somebody who represents FSFTN, like @welkin or @commons_sibi, should register for StartSSL: https://www.startssl.com/ Use Express Lane and register. That’s the first step. Then I am assuming they’d login to the control panel and then create a free cert.


#15

I’ll take care of enabling https once we get the certificate.


#16

Let’s Encrypt has been around for more than a month now. It’s very easy to use. Please set up https as soon as possible.


#17

I am on it. Will do it.


#18

Finally it’s done. This forum is now served in HTTPS by default and the certificates are authorized by Let’s Encrypt. Closing this discussion thread.


#19

#20

இதுக்கு தான் ஊர்ல ஒரு ஆல் இன் ஆல் அழகு ராஜா வேணுங்றது :slight_smile: