SSL Certificate out of date?

[beetle496]

On the forums, I am getting the “Not Secure” warning. This usually happens when a website serve httpS (instead of plain http) without an up-to-date SSL certificate/credential.

Any timeframe for getting this fixed?

I ask mostly because (1) the “remember me” is not working (at least not for the browser/settings I am using) so I have to keep entering my id/pw. But also, (2) one should not be entering pw without https. If the “Not Secure” warning is only due to your certificate being expired, then pw are still being encrypted, so (2) is not a concern.

Thanks!

[ericbsmith]

It looks like they had a TLS certificate expire on Oct 24, which is what's causing the issues. I expect they'll be able to address it on Monday.

[ericbsmith]

I dropped a line to webmaster@sjgames.com and they sent a note back letting me know the issue has been fixed.

[beetle496]

I was experiencing the poor behavior at least a few days before the 24th, and now still. The “not secure” messages comes up on different computer, so I do not think it is only my browser.

[Anthony]

Originally Posted by beetle496

I was experiencing the poor behavior at least a few days before the 24th, and now still. The “not secure” messages comes up on different computer, so I do not think it is only my browser.

There's two long-standing security issues that you might be running across:

1. The forums do not automatically redirect to https on a login attempt, though you can go there manually if you want.
2. The banner image is served via http whether or not you connect via https.

Neither is likely to be fixed any time soon. In general I would just treat it as an insecure website: don't use a password you use anywhere else, and don't store anything private.

[Fufu]

Like many fans, I will be ecstatic when they upgrade the forums. SJGames is missing an excellent opportunity in the SEO (Search Engine Optimization) game. SEO would greatly increase their product exposure in cyberspace and become a more competitive game publisher.

Could you copy and paste those unsecure links to the SJGames webmaster?

[Anthony]

Originally Posted by Fufu

Could you copy and paste those unsecure links to the SJGames webmaster?

It's not a limited set of links, it's a global thing. Expected behavior for a modern website is to have everything https. In the case of the forums, the main problems are:

1. Visiting the forums by http: should just immediately redirect you (301/302) to https. In 2021 there is never a legitimate reason to run a comment system by http:
2. The images are served from http://www.sjgames.com/img/*. They should be served by https.
3. They are running bulletin software that hasn't been supported in a decade and probably has unpatchable security holes.

Problem 1 is fairly trivial unless their apache server is astonishingly old. Problem 2 is a modest amount of low-risk work.
Problem 3 is a substantial amount of high-risk work.

[beetle496]

Thank you @Anthony!

Originally Posted by Anthony

The forums do not automatically redirect to https on a login attempt, though you can go there manually if you want.

Manually entering https seems to have resolved the annoyance of having to manually log in all the time.

I am embarrassed to not have thought of that! Manually adding the “s” was pretty routine, back in the day, and something I should have thought to try. Now that browsers tend not to show the full URL, it is easier to overlook.

Get off my lawn!