(RESOLVED) Will it ever be implemented? HTTPS

[Jack Mansfield]

Hi,

Implementing HTTPS is still on the cards and a work in progress. Thank you for your patience.

Jack

[randlemarcus]

Jack Mansfield said:

Thank you for your patience.

Mine ran out. Which is why you'll be getting a memo from the Haymarket Global Data Protection Officer. Sorry.

[All that jazz]

Jack Mansfield said:

Hi,

Implementing HTTPS is still on the cards and a work in progress. Thank you for your patience.

Jack

It's been a "work in progress" for over 12 months. Can we have a date it will be implemented by please. ReacingPete promised it would be done by this month! Was that a lie then?

[VEA]

Jack Mansfield said:

on the cards

Sounds like it hasn't been decided at all.

Toss, utter toss.

[Mattt]

Haymarket should be ashamed of their performance with this issue.

[MagicalTrevor]

Mattt said:

Haymarket should be ashamed of their performance with this issue.

Just this one issue?

[Vaud]

MagicalTrevor said:

Mattt said:

Haymarket should be ashamed of their performance with this issue.

Just this one issue?

The "compliance" ones are important... https and phonesafe are easy fixes that no-one cares about, but they should as they could bite them very hard... it's not "can we have avatars".

[dmsims]

Vaud said:

The "compliance" ones are important... https and phonesafe are easy fixes that no-one cares about, but they should as they could bite them very hard... it's not "can we have avatars".

Yeah because Tarquin in marketing says it will have no effect on sales and whoever the latest white spectacled (no lenses), fixie bike manager is CBA

[All that jazz]

anonymous said:

[redacted]

Clear cut to anyone with a basic understanding of English.

[Dan_1981]

I still don't think Pete works here anymore.....

His posts don't have the PHStaff tag....

[Vaud]

anonymous said:

[redacted]

Actually it's ambiguous, but I agree with your sentiment.

• which is currently being resolved with a January deadline - could mean the "deadline" is in Jan, of the start of Jan, or the end of Jan
• which is currently being resolved with a deadline of the start of of Jan - still ambiguous as "start" could mean around the 1st
• which is currently being resolved with a deadline of Jan 31 5pm - clear cut
• which is currently being resolved with a deadline of Jan 1 5pm - clear cut

But this is PH, we don't argue about semantics, do we?

[All that jazz]

Regardless of the semantics, it needs to be in place within the next 12 days as per Pete's post. So let's make sure it happens Jack Mansfield (or whoever the chief cheese is here these days)?

[All that jazz]

anonymous said:

[redacted]

Enough hair-splitting - find something better to do with your time - just get the damned https done already!

[Mattt]

If the whole site HTTPS project is delayed, a company like Haymarket could sort the login form as a minimum within a day.

[dmsims]

Mattt said:

If the whole site HTTPS project is delayed, a company like Haymarket could sort the login form as a minimum within an hour.

EFA

[thebraketester]

Why doesnt someone breach the security flaw and send Haymarket some usernames and passwords? I would do If i could... but I dont know how.

[GreigM]

dmsims said:

Mattt said:

If the whole site HTTPS project is delayed, a company like Haymarket could sort the login form as a minimum within an hour.

EFA

This is what I don't really understand - pretty much all we need is for the login to be https. The rest of the site (inc advertising ste) could be left as-is. JUST DON'T SEND THE PASSWORDS IN CLEAR TEXT!!!

So what if it isn't a permanent green padlock sign - I don't really care, so long as the password is encrypted.

And can we make the big assumption that the passwords are at least not kept unencrypted in the back end database?

[Tonsko]

GreigM said:

And can we make the big assumption that the passwords are at least not kept unencrypted in the back end database?

MD5.

Run!

[GreigM]

Tonsko said:

MD5.

Run!

Hey, I'd take it over cleartext. Most "hackers" have limited capability beyond running the scripts they download, would someone really put in the effort to extract and brute-force an MD5 hash....for PISTONHEADS logins?

That being said if it is MD5 the code structure is in place for the hashing process - so would be a 5 min job to upgrade to something with decent strength.

[768]

MD5 is near enough pointless, it's not a barrier.

Some people will be using the same passwords elsewhere.