HTTPS is enabled on MVS

[matthew1]

If you don't know what this means, don't worry about it, it won't affect your life in any way. Or read about it here. In short, it encrypts your communication with MVS.

You may or may not see a lock icon in your browser when you connect. If you don't, don't worry, it's still working as long as your URL has an "s" after "http"...



The difference is the "s" after the "http". That means "secure". When you log in, use this ucp.php?mode=login and your username and password will be encrypted.

If You Don't See a Green Lock Icon

There are different types of encryption, and as far as I know, they're all strong (if you're using a modern browser), the difference is in the certificate my server operates under. It's a general-purpose certificate, not a dedicated one. Like I said, I don't think the encryption strength is any less than any other HTTPS connection, only that I haven't jumped through the hoops to get a dedicated certificate. MVS runs under a Cloudflare certificate.

I've got some further testing/fixing to do, and if you want to help, reply to this topic with the bug report.

Known problems

Internal redirects falling out of HTTPS to HTTP

example:

• log in
• go to https://www.matthewsvolvosite.com/
• in upper right navigation, click on Forums -> Log in / Register

result:

• browser falls out of HTTPS, lands at https://www.matthewsvolvosite.com/forums/index.php

If you want to help, use that same format above in red to list bugs you find.

Moving forward

After a week or two of you guys testing this and me fixing what we find, I'll instruct the MVS server to enforce HTTPS on all urls.

Currently, you have to be vigilant to see if your browser is falling out of HTTPS while you click around.

Questions? Comments? Leave them below.

[jblackburn]

We just went through all of this at work.

Mine works once I put the S in front of it.

All my bookmarks are through HTTP though - so if those are automatically directed, not an issue. If they *aren't*, that could break bookmarks for a lot of people.

[matthew1]

When I throw the force HTTPS switch, it'll redirect from HTTP to HTTPS. You won't have to do a thing.

[93Regina]

Known problem

Internal redirects falling out of HTTPS to HTTP

example:

I use this https URL for 'walking' into this site, and then login at bottom of this https page, which then causes a change to http after login.

[matthew1]

Thanks 93Regina! Fixed.

Everything Here Is Secure

HTTPS is now forced on all MVS pages. It's not optional any longer. All communication between you/your browser and the MVS server is encrypted. Passwords, logins, pages' content, your posts to MVS forums, images, everything.

But... Why?

If you ask "Why is this important for MVS? There's nothing to buy (no credit card info), no real names required, no nudie photos... why?" I'll let Google answer that here https://www.google.com/transparencyrepo ... tls/?hl=en

It's above my pay grade, but I do value privacy. For what it's worth, Google began encrypting everything... searches, Gmail, all their content, in 2011.

Having Trouble with the "S"?

If you're having trouble with HTTPS pages, and it's because of the HTTPS setting, it's likely you have a very old browser... like a decade old. Also, it's very likely you can't read this anyway .

Contact me if you're having trouble with MVS in any regard.

[93Regina]

But... Why?

The UK now wields unprecedented surveillance powers — here’s what it means
...
...
...
A NATION'S BROWSER HISTORY and a search engine to match


The UK government will keep a record of every website every citizen visits for up to a year, with this information also including the apps they use on their phone, and the metadata of their calls. This information is known as internet connection records, or ICRs, and won’t include the exact URL of each site someone visits, but the base domain. For this particular webpage, for example, the government would know you went to http://www.theverge.com, the time you visited, how long you stayed, your IP address, and some information about your computer — but no individual pages.

Each Internet Service Provider (ISP) and mobile carrier in the UK will have to store this data, which the government will pay them to do.
...
...
...
Update November 29th: The story has been updated to note that the Bill has now received royal assent and is officially law.