Jump to content



Recommended Posts

Unless you are making financial transactions or are sending sensitive personal information it should be OK. I don't think many of us are doing those things on here. But whatever makes you feel safest.

SSL serves three purposes (I'll use a snail-mail analogy to illustrate):

  1. Keep the communication secret: prevent the mailman from reading your letters.
  2. Verify that the communication is unaltered: prevent the mailman from altering your letters.
  3. Verify the identity of the sender: prevent someone else from sending you letters under a false name.

Note that points 1 and 2 are worthless unless 3 is intact: if someone else can impersonate the originator of a message, then encrypting it does nothing but prevent yet another attacker from hacking your already-compromised communication. If you click through an unverified or untrusted certificate, this is what you are risking - the communication will still be encrypted, but the server you're talking to may not be legit.

That said, there are a few situations where it is relatively safe to click through the warning:

  • When you're not sending or receiving any confidential data, such as passwords or credit card details; note that cookies containing session IDs etc. are also confidential, so you shouldn't do this when you plan to use anything that requires logging in. Also, consider that a bad certificate can be a sign of malicious activity, so you should be extra careful when this happens.
  • When you can verify the identity of the server through other means:
    • when the server is on the same local area network (behind the same router / firewall), and the server IP has been obtained through a trusted DNS or a local hosts file;
    • when you can check the certificate's (SHA-1 or other) fingerprint through a different channel (e.g. logging into the server and checking it there): as seen from the client, it must match the known certificate as installed on the server. The connection could still be hijacked, but doing this from outside the network is only possible if the firewall / router is compromised (and when that happens, you have other things to worry about).
Link to comment
Share on other sites

I get enough spam already.

On top of that anyone who signs in gets their password stolen. Your location is stolen. All the cookies you are carrying showing your browsing history is stolen.

This is just like not wearing a mask for covid. Plenty of excuses and only one solution= Be responsible and make the web site proper so their are a lot less chances of victims because of your laziness. Same with masking up in public, quit being lazy and wear it. 

I'm totally fed up with lazy people being stupid when the stakes are so high. 

And with that, until this site 'masks up' you are all free to enjoy whatever happens when you press your luck. I'm going to keep doing the right thing and hope I'm lucky enough not to suffer or cause anyone else to suffer. 

Link to comment
Share on other sites

16 hours ago, dwkl said:

Thank You Wild Bill - That is what it is.  I left the planet for a small break on Thursday for the weekend and of course it happened then.  I am getting it fixed.

Seems to me you probably got repeated prompts to renew it. 

Yet you did nothing until I posted this thread. 

Glad I could bring it to your attention.

To put things into perspective, no one should ever use a website that doesn't have these basic protections. Sure, it could be nothing, or it could be the first sign that a website was taken over for uses that are not in anyone here's best interest. That's why you get the warning. Because something is wrong. Ignore warnings and suffer, it's how the world rolls and it's much less 'forgivable' these days. 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...