2

Unlike any other site, Area 51's main site is unencrypted, its login forms are partially or wholly insecure and its login forms completely break under the browser extension HTTPS Everywhere. That doesn't happen on any other sites. This is madness Sparta.

Mere months ago Mark Henderson nailed the spirit: Let's encrypt all the things. But:

  • When I use the HTTPSEverywhere extension on Firefox 50.0.2, the login form appears secure until you try to log in, at which point it barfs

    Unable to log in with your OpenID provider: <Big Wall of Red Text>
    

    and I can't login.

  • And when I disable the extension I get either an unsecured or only partially secured form, leaving it unclear to me if my PW is being sent in clear text over the intertubes.

    Then when I'm logged in the site isn't secure at all.

In case that matters I'm running Linux and it's fully up-to-date with security patches.

Can Area 51 get area defenses (cryptography) actually worthy of the name?

  • Related or dup: meta.stackexchange.com/q/116782/245360 – Patrick Hofman Dec 13 '16 at 9:49
  • 1
    @Pat not really, I'm pretty sure Area 51 is not on the roadmap for HTTPS/SSL support for SE, and even if it is on the list, it's in the very bottom. It's an old site, running on old code base, and SE want to get rid of it for long time. (See this.) – Shadow9 Dec 13 '16 at 10:19
  • Okay, I thought the login screen was shared, but I guess I haven't seen it recently either @Sha – Patrick Hofman Dec 13 '16 at 10:20
  • @ShadowWizard Beuuurk so Area 51 is basically guaranteed not to get encryption, because it's going to get nuked in roughly the same timeframe? – Iwillnotexist Idonotexist Dec 13 '16 at 10:40
  • @IwillnotexistIdonotexist as far as I can tell, yes that's the case. – Shadow9 Dec 13 '16 at 10:59
  • 2
    @ShadowWizard We have no active plans to remove or replace Area 51 at the moment. We do, however, intend to fix this particular login issue as part of the overall SSL support work. – Adam Lear Dec 13 '16 at 18:19
  • 1
    I'm a bit hazy on whether A51 overall is gonna become available over HTTPS. IIRC it basically works now with HTTPS Everywhere except for the logging in part. As far as I know, we do not send any passwords in plain text now (and I'd be very surprised if we were), so just disabling the extension long enough to log in should be safe. – Adam Lear Dec 13 '16 at 18:21
  • @Adam well, that's a mistake I'm happy to make. Thanks! – Shadow9 Dec 13 '16 at 18:53
  • @AdamLear I used the whole SE with a modified https everywhere years long, and everything worked, also the login part of the a51 (of course the bad cert warnings should have been enforced by the browser). – peterh - Reinstate Monica Apr 23 '17 at 1:42
  • @peterh Congrats? Turn off HTTPS Everywhere or similar extentions long enough to log in if that's a problem you're running into now. Having the extensions enabled on A51 for login never worked as far as a I know (but will be fixed up as we finish HTTPS support on our end). If you got it working... cool. It's possible your modifications are gonna break or have broken already? I'm not sure what you're going for with a comment here 4 months after the OP's post. – Adam Lear Apr 23 '17 at 3:19
  • @AnnaLear I only made the https used SE-wide, everywhere. It wasn't accepted (more exactly, quickly reverted) patch by the upstream, because it caused mcb errors (which didn't happen in my system because my adblocker). Everything worked pretty fine for me, and fortunately after you've made the https switch ready, it works everything even now, even without the https :-) I only mentioned that yes, also the https login on the a51 worked well, I don't remember any problem. (At the time I used a51 a lot.) – peterh - Reinstate Monica Apr 23 '17 at 5:05

Browse other questions tagged .