Insecure connection?

[Wardog]

I've just done a reset to factory settings on my laptop, and now when I try to log in to GITP, I get a "This connection is not secure" warning.

Is there something up with the site, or have I not reconfigured my laptop properly?

[Manga Shoggoth]

Some browsers are now "enforcing" https connections rather than http for security purposes. You should be able to upate the browser settings to allow http (and the message usually gives some hint on how to do this).

What probably happened was that your factory reset also took out that settings update.

[Alent]

On this note, is there any plan to get a security cert for the site? The playground is one of the few places I visit that doesn't offer https:// these days, and while normally I don't think anything of it, I've been on the road and hesitant to log in to the forum from some of the open hotspots I've had to use. (Hurray for VPNs.)

[Random Poster]

So apparently www.giantitp.com does support https (which is good) but uses a self-signed certificate (not so good). Basically this means that the connection between the server and a user is secure, but doesn't guarantee that the server is actually the real www.giantitp.com server. While it's not very likely that anyone would bother to perform a man-in-the-middle attack against this site, that's really no excuse to have such an obvious security hole, especially since Let's Encrypt (https://letsencrypt.org/) is a free and widely used certificate authority.

[Drumbum42]

So apparently www.giantitp.com does support https (which is good) but uses a self-signed certificate (not so good). Basically this means that the connection between the server and a user is secure, but doesn't guarantee that the server is actually the real www.giantitp.com server. While it's not very likely that anyone would bother to perform a man-in-the-middle attack against this site, that's really no excuse to have such an obvious security hole, especially since Let's Encrypt (https://letsencrypt.org/) is a free and widely used certificate authority.

So, I was about to say that this may not be possible depending on their setup, but apparently certbot has a manual mode! Though it is a little time intensive, as you need to do this every 90 days. (A problem solved through automation if you have a VPS)

I'm actually going to go use manual mode on a server this weekend. (Using selfsigned for a minor webpage)