HTTPS wrinkle

Printer-friendly version

Forums: 

I have noticed that the site has changed from https:// to https:// recently. This was an unexpected and rather disturbing event, since I was presented with a login page without my username and password filled in!

I have the login screen set as my bookmark: https://bigclosetr.us/topshelf/user/login?destination=node

Suspecting a fake website attempting to steal my login credentials I checked carefully and only then noticed the protocol change. A good thing, but it may have caught out others who, like me, store credentials so that we don't have to keep re-inputting them. (The password save mechanism depends on the exact URL.)

When the https:// version of this comes up I get a gray (locked) padlock with a yellow warning triangle. Mouse-hovering gives me the text: "This website does not supply identity information." I do not see this behavior with the homepage. Once logged in I get the normal green locked padlock (Firefox).

This might be just a wrinkle on that particular screen or it might be something left unconfigured. I thought it a good idea to let you know.

Penny

PS Bookmarks now updated to avoid redirections.

Unfortunately, this was

Piper's picture

Unfortunately, this was caused by a new push by Google to force more sites to use HTTPS. Any site that submits any form that includes email or passwords will have a large "Insecure" banner placed at the top of the page. Because this push was presented to us suddenly we had to work fast to implement a system that worked as completely as possible with legacy systems and codes that don't all support HTTPS.

We've done our best to implement things without imposing excess latency. I'm sorry you are having issues with FireFox and when I get back from my coming vacation I will do my best to investigate this. Everything seems to be working perfectly in the latest Google Chrome browsers.

Google Chrome HTTPS Screenshot


"She was like a butterfly, full of color and vibrancy when she chose to open her wings, yet hardly visible when she closed them."
— Geraldine Brooks


Only Chrome?

As this load of spyware will never see the ligt of day on any machine of mine (imho, anything supplied by Alphabet is only done to increase the data they slurp and thus their Ad revenue)
what about other browsers.
Firefox
Safari
IE
Edge
Opera
Please say that you test the site on other browsers.

Samantha
{40+ years of software development behind me}

Firefox

Patricia Marie Allen's picture

I'm using Firefox 50.1.0. I experienced one time of not being logged in. Since I wasn't there to leave any content or look for messages, as I only had a few minutes to check for added chapters to stories I'm reading, I didn't worry about, figuring I would deal with it the next time when I had more time.

Firefox seems to have adapted and the next time I logged in, everything was as normal with the exception that no longer get the confirmed log in at the top of the page. If I'm in doubt I need to go down the right side to see that I'm logged in.

Hugs
Patricia

Happiness is being all dressed up and HAVING some place to go.
Semper in femineo gerunt

Firefox releases

I find the mainstream release a bit too speedy for my liking. Getting old I guess :)
I use the ESR stream (ESR = Extended Service Release). Functionality gets updated at a slower rate than the main release. Security updates are applied when needed.
My current release is 46.6.0

Samantha

Safari

I noticed my visited links were all reset to unvisited and I am using Safari Version 10.0.2. I assume that the cookies are no longer valid, or something similar?

Safari's Link Tracking

Piper's picture

That actually has nothing to do with cookies, or our programming but Safari and the way it tracks visited links. It see's http and https links as two different beasts so now that all the links are https instead of http it sees new links. :)

-HuGgLeS-
-Piper


"She was like a butterfly, full of color and vibrancy when she chose to open her wings, yet hardly visible when she closed them."
— Geraldine Brooks


OK

I see, thanks for the reply.

I saw that, too,

The links for stories I've read or looked at having been reset, I mean, around 12:30 AM Saturday.

To put it bluntly, I wasn't happy, as I like knowing whether I've read something already without having to click the story or part to actually see it (I give a kudo for just about everything I read, some stories aren't great, but the writer put an effort into it, and it doesn't hurt to be nice).

Color me stupid

I looked at the two examples Penny provided and to me they look identical. By that I mean both seem to be https://

I'm using Firefox on an older Samsung Tab 2 that hasn't had android updated in a while, its just too old. I'm not pretending to be stupid, it appears to be a native talent. :-(


"Life is not measured by the breaths you take, but by the moments that take your breath away.”
George Carlin

Site Links

You won't notice any difference since the site will now "redirect" any http:// visitors to the https:// site without you even noticing.

The only reason I noticed anything was because, as I reported, my login details suddenly disappeared. I'm sufficiently long in the tooth, in IT terms, for me to wonder if somebody had found a way to scrape login and password details from visitors, but it seems that everything is actually fine.

Penny

Not the address line

I'm talking about your message text. "I have noticed that the site has changed from https:// to https:// recently. " Notice the underlined parts are identical. As far as I know Firefox has not taken to altering the message body that I see.


"Life is not measured by the breaths you take, but by the moments that take your breath away.”
George Carlin

Gah. My goof.

Sorry, you're quite right. I thought I fixed that before I posted and afterwards I just rolled over it. The first one should have been http:// of course.

That's why it is important that authors get somebody else to check their posts before they are released into the wild.

Penny