Forum HTTPS connections still vulnerable

_RiO_

Well, I certainly was happy to see that the forums are now operated over HTTPS instead of plaintext.

However, I quickly ran the site through the free testing facilities of SSL Labs and lo and behold;

• The server supports weak Diffie-Hellman key exchanges, which opens connections up to the Logjam exploit.
• The server continues to support the SSL 3 protocol, which opens connections up to a POODLE attack.
• The server continues to support the RC4 cipher, which has known vulnerabilities.
• The server has one or more weak and breakable SHA-1 signed certificates in its certificate chain; it should be using SHA-2 up the entire chain.
  (This one will actually have to be solved by 2016, as all major browsers are going to actively block connections that use a SHA-1 signed certificate as part of the chain.)

Looks like a bit more work is needed...

Unknown

_RiO_ wrote:

Looks like a bit more work is needed

Welcome to MPQ