FireFox rejecting forum address login option as not secure

[JohnJR]

Hi Folks,

I wanted to login (username, password) to the forums, regarding another issue than this one, and received a Firefox 64.0 "this site is not secure" warning from the login window, the address is the one I've always used (I thought because it has always come up automatically from this site): www.forums.scribus.net/canvas.  Adding https:// to the address produced ever more dire warnings from Firefox, so of course I stopped.

Blocked from my account, I saw no way to contact you; none of the contact options do anything but go around in a circle or have no active links.

There is no help on Google for this, thus I tried a different browser, Safari.  With the same Scribus address and the same forum window came right up with the login option.   the login procedure did not give me any warnings and logged me in for this post.  Safari didn't bother to tell me if the proper https:// had been added to the selection, who knows.

I'm nearly a complete neophyte, but this seems to me to be a case of Scribus needing to get righteous with FireFox, who monitors security more closely than other browsers it seems.  Can you do this, or will you do this?  The issue seems to the neophyte to be one of proper SSL certification.

As a side note, my iMac with OS X 10.11.6, perhaps because of me, crashed with the big stop sign "Signal 11 Error".  Upon recovery the Scribus document that was open has since operationally mis-behaved and is sporadic in ways that are bizarre.  I ran my Malware app. and it shows me to be clean, however I think you can see why I would and should take a FireFox warning very seriously.

Thanks,

John

[radu81]

This site does not use a secure connection (https) but a normal connection http. It is "normal" that browsers like Chrome or Firefox to display those warnings. It's not your PC or your browser

[JohnJR]

Hi Radius,

I'm still very skeptical of just excepting this because FireFox rejected the login page, and continues to do so.  I tried the forums address again and noted the address is still "forums.scribus".  (Please note, I added the "www" in my post below, which apparently is not part of the address as I quoted it.)

Upon closer inspection there isn't any http://, let alone https://.  In that screen shot is the FireFox padlock icon with a red line through it. It gets worse if you try to bypass it. Also note the word "forums" is greyed out but is still visible.  I tried adding http://and the page merely reverted.

Bye the way, I was going to login over an issue after several "Signal 11" crashes where my existing document has turned into scrambled eggs.  So not knowing more, if FireFox gives me this warning for login username and password, I'm going to believe it.

Thanks,

John

[a.l.e]

there is a double problem with the way this forum is setup:

- the ssl certificate has expired several years ago
- the https site is not the default one

the scribus team does have a valid certificate which is used for www.scribus.net, bugs.scribus.net, and wiki.scribus.net ... no idea why they're not using it for the forums, too.

i've opened a ticket for this

https://bugs.scribus.net/view.php?id=14625

but there has been no activity.

since browsers are starting to warn the users about dangerous behaviors,  this is becoming a urgent issue.

now, what's the issue for you?

as long as your connection is secure (safe office or home cable or wifi network) there is not much you should be scared of (bad things can always happen, but they are unlikely).
on the other side, if you're using a public wifi without a wpa password, everybody on the same network will be able to see all your (non https) communication. inclusive your password when you login
this having been said, even if the certificate has expired, using the "invalid" https connection will probably protect  you from other people spying on you.

what can you do?

• make sure that the password you're using for the scribus forums is only in use for this forum. please don't tell it to anybody, but consider it as public knowledge.
• don't put too much information about you in the profile (your real first and last name are propbably ok, but not more than that).
• eventually, refrain from logging in from public wifis (hotels, train stations, airports, ...).

[JohnJR]

Thanks a.l.e for a general tutorial on the issue and giving me some comfort.

John