Security: Add SSL/TSL/HTTPS Support [Accepted]

Offline

Jan 2005

356

Ohai there, Xinil.

How about allowing to change the protocol of the personal site in "Profile" from HTTP to HTTPS also?

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 18, 2011 9:24 PM

Cashdax

Offline

Feb 2010

2171

Going for an SSL connection huh?

There's not much of use anyway. Since the site is generally only a list of your anime(s). No money is involved so. T-down.

"Your taste is shit cause you like what I hate. Believe me I have 1000 cartoons that I rated with less than 5."

Sep 19, 2011 5:04 PM

Offline

Jan 2005

356

I'd still rather have secure connections to our site than not, and should not be a hard implementation

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 19, 2011 6:36 PM

Cashdax

Offline

Feb 2010

2171

Arinohyoshi said:
I'd still rather have secure connections to our site than not, and should not be a hard implementation

But it's usage would be questionable. The question is: "For what?"

"Your taste is shit cause you like what I hate. Believe me I have 1000 cartoons that I rated with less than 5."

Sep 20, 2011 11:57 PM

robfoster

Offline

Feb 2010

1762

Cashdaxxx said:

Arinohyoshi said:
I'd still rather have secure connections to our site than not, and should not be a hard implementation

But it's usage would be questionable. The question is: "For what?"

Because otherwise "they" will find out what he does here.

Sep 21, 2011 12:42 AM

Zephys

Offline

Apr 2007

826

Cashdaxxx said:

Arinohyoshi said:
I'd still rather have secure connections to our site than not, and should not be a hard implementation

But it's usage would be questionable. The question is: "For what?"

More like, why not?
It shouldn't be that hard to implement.

Sep 21, 2011 3:31 AM

#10

Offline

Jan 2005

356

Because I'd rather go for the security, than not going for the security. Having everyone to use secure connection over not secure is just pure win.

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 21, 2011 7:19 AM

#11

Cashdax

Offline

Feb 2010

2171

Arinohyoshi said:
Because I'd rather go for the security, than not going for the security. Having everyone to use secure connection over not secure is just pure win.

What are you trying to hide anyway? They're only lists and online friends here though.

"Your taste is shit cause you like what I hate. Believe me I have 1000 cartoons that I rated with less than 5."

Sep 21, 2011 9:26 PM

#12

Offline

Jan 2005

356

Cashdaxxx said:
What are you trying to hide anyway? They're only lists and online friends here though.

Hide? O_o
It seems to me that you didnt apprehend what I wanted:

I don't want to hide anything, but what I do want is everyone to use our website with SSL.

What I want is to have with SSL is the website on our profile, which needs adding a checkbox with "Use secure HTTP" or a dropdown list with http and https as options.

I'm not talking about having MAL itself with SSL.

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 24, 2011 9:14 AM

#13

saka

Offline

May 2008

4052

People tend to forget that an SSL cert costs money, and I'd rather have that money spent toward much-needed hardware and development time than on encrypting non-sensitive data. All the information except maybe PMs is public anyway to anybody who views your profile. If you don't want other people to know about it then don't post it. There really is nothing on mal that is private enough to warrant encrypting, and really the only danger you have is maybe somebody sniffing your password from an unsecured router.

If you're truly concerned, then just use a tunnel through any of various free SSL proxies, to make local sniffing harder. There is essentially no risk once it gets to a backbone.

I am a banana.

Sep 24, 2011 9:25 AM

#14

Offline

Jan 2005

356

And yet again, I am NOT talking about getting SSL certificate and HTTPS on MyAnimeList.

I'm talking about the PERSONAL WEBSITE that everyone can put up in their own Profile information (In my case: pingtimeout.net ). What I want is a possibility to set that up in my profile with HTTPS:// instead of the forced HTTP:// it now offers.

We have a cert already at pingtimeout.net and we want people to use the site with SSL rather than not.

Does my english fail so much that its hard to understand what I'm wanting here :(

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 24, 2011 10:23 AM

#15

saka

Offline

May 2008

4052

Oh I see what you mean. I never realized that https didn't work there, but you're right that this needs to be remedied. There is really no reason to restrict urls to only http.

^ That field should just take a url and enforce "^https?://" then add the protocol if it's missing. I will try to bring attention to fixing it.

I am a banana.

Sep 24, 2011 11:23 AM

#16

Offline

Jan 2005

356

Yay, thank you <3

Also a personal note to take, I should have taken a screenshot from the beginning, it would have saved alot of posts and making my point easier to understand.

ArinohyoshiSep 24, 2011 11:26 AM

Truly yours, Arinohyoshi

~ Join the SOL Brigade Today! ~ Save our World by Overloading it with Lolis! ~

Sep 24, 2011 12:03 PM

#17

saka

Offline

May 2008

4052

In the meantime you could just redirect the http urls to https using mod_rewrite.... since you might as well use https if you have it.... or if you don't want to do it site-wide then just make a script on your site that redirects to the https url.

I am a banana.

Mar 30, 2012 2:56 PM

#18

cshin9

Offline

Sep 2009

The reason I'd want this is because I have an account and a password. The profile also has spaces for personal information, but I wouldn't want to enter any without more security.

Mar 14, 2014 6:24 AM

#19

MrGemeco

Offline

Mar 2014

I assume I post this in the correct parts of the forums. But I am wondering why this website is not configured with HTTPS. It seems like Myanimelist is a heavily used and popular portal to anime and manga used by a lot of people. It requires a sign up to use any of the features on the website, but there is no SSL support? Damn, do you guys not even care about your users security? Every password used on sign up is exposed as plain text over the the network, every email is exposed, everything, seems like there's a lot of ads on this website and an SSL certificate is not a lot of work to get and it costs approximately $15 a year, so I do not see any reason for this not to have been done yet, lack of knowledge?

It also seems like the website uses cookies assigned to the IP address? Well, that is kind of a trouble due to the fact that I often move a lot around and my VPN switches IP every five minutes so I can not use VPN on this website, I assume it is to prevent people from stealing others cookies but without SSL that's just a futile attempt since if the attacker can get the cookie, they can probably also get the password of a user as well.

Sorry about ranting and I could probably write this more formally but it is a major security issue, failing at such a simple thing could even mean that the passwords aren't even stored in the database with hash+salt and instead in plaintext.

MrGemecoMar 14, 2014 6:57 AM

Mar 14, 2014 6:35 AM

#20

jojovonjo

Offline

Dec 2011

273

All known problems and all things that will never be fixed.

Mar 14, 2014 6:50 AM

#21

MrGemeco

Offline

Mar 2014

Why won't this be fixed exactly, there is basically no work to get it done.

Mar 14, 2014 6:59 AM

#22

worldeditor11

Offline

Apr 2013

12542

MrGemeco said:
Why won't this be fixed exactly, there is basically no work to get it done.

Because of Crave and Xinil.

Mar 14, 2014 7:07 AM

#23

Offline

Oct 2009

7669

MrGemeco said:
Why won't this be fixed exactly, there is basically no work to get it done.

Because the only person that has the power to implement it doesn't give a damn. I can safely bet 1000$ vs your 1$ that he won't even read it and still feel guilty like I stole your 1$

Mar 14, 2014 7:15 AM

#24

MrGemeco

Offline

Mar 2014

Hmm, it's certainly depressing to hear when the developers of a popular website doesn't give a damn about it's users. I guess I will just go and do make own thing since especially that cookie IP thing is seriously a deal breaker for me. Thanks for the replies though! Sadly I do not have a dollar to bet.

Sep 15, 2014 4:21 PM

#25

Lokie

Offline

Oct 2007

Searching a bit I saw that https doesn't seem to be in the TO DO list of the admins. Yes on the one hand it's just our animelists but anything that requires login should be behind https and on the other hand, seriously why not use https?

Anyway since the almighty google from now on or soonish will give priority on it's search results to sites that use https wouldn't it be in the best internet of mal to do it?

tldr: there is absolutely no reason not to use https and every reason to use it.

Sep 15, 2014 4:53 PM

#26

Offline

Oct 2009

7669

Lokie said:
Searching a bit I saw that https doesn't seem to be in the TO DO list of the admins.

Hahaha. When was that list updated last time?

Sep 15, 2014 5:11 PM

#27

lupadim

Offline

Aug 2012

10014

What was the last time that anything changed on MAL at all? If I remember well, they tried to add a background, but as I am using a different theme I can't even be 100% sure of that.

As long as we have "MSN" on our profiles, we will never be evolving.

Sep 15, 2014 5:16 PM

#28

kiss

Offline

Sep 2011

11111

You don't use MSN lupachin~?

Then who's MSN did you give me??? Did you stand me up???????? ;___;

hidoi

Lorem ipsum dolor sit amet

Sep 15, 2014 5:45 PM

#29

Malandrix

Offline

Feb 2014

495

Being exposed makes us live on the edge.

I guess it's an adrenaline thing.

"Everything you see on the internet isn't true." -Abraham Lincoln

Sep 15, 2014 6:48 PM

#30

winmac32

Offline

Aug 2014

317

Lokie said:
tldr: there is absolutely no reason not to use https and every reason to use it.

Well. There are reasons not to use HTTPS.

But I agree with you that in this case, especially when handling authentication and the user's session, HTTPS should definitely be used. Sending passwords or your Session ID in plain text over the internet is an awful idea.

We can dance if we want to.
Web Development and Programming: The sexiest place on earth

Sep 15, 2014 8:46 PM

#31

Subbed

Offline

Mar 2013

5831

I don't know how to feel when reading all these responses. Truth be told, if I balance it out how useful the secure http would be and how taxing it would be for the servers (constant encrypting is a taxing matter), I always come to a conclusion that we are better off without it. Have we ever experienced wiretapping or man-in-the-middle attacks? Nah, not really, as far as I know. Yet, those are the only things a secure http protects you from.

It's rather funny how misleading vision many have on just what https is. It's not enhanced security. It's just encrypting of input data, which basically disallows others that somehow manage to get a direct access from reading it. But that's not what happens on MAL. Here, users and mods get phished or keylogged, and a https can't do a thing about it.

Long story short, I'm always up for a secure protocol, but not in this case. The servers are so shitty that it would bring far more damage than profit, imho.

Sep 16, 2014 2:49 PM

#32

lupadim

Offline

Aug 2012

10014

Lime_ said:
You don't use MSN lupachin~?

Then who's MSN did you give me??? Did you stand me up???????? ;___;

hidoi

W-what? You'd manage to troll me if I didn't know that MSN doesn't exist anymore

Sep 16, 2014 3:10 PM

#33

xbobx

Offline

Jun 2010

2561

Hello there, my dear friend.
Thank you for your concern!

This is Crave™-tan.
I'm speaking in behalf of The Elder Gods, also known as "the ones who rules your cartoons website"
We will never update anything on this said © MyAnimeList.net basically because it isn't lucrative and has a really bad traffic flow.
But hey, we gave you Incapsula™, be thankful!

Best regards, CraveOnline™

http://fakemorisummer.wordpress.com/

Sep 16, 2014 9:37 PM

#34

winmac32

Offline

Aug 2014

317

subpyro said:
I don't know how to feel when reading all these responses. Truth be told, if I balance it out how useful the secure http would be and how taxing it would be for the servers (constant encrypting is a taxing matter), I always come to a conclusion that we are better off without it. Have we ever experienced wiretapping or man-in-the-middle attacks? Nah, not really, as far as I know. Yet, those are the only things a secure http protects you from.

It's rather funny how misleading vision many have on just what https is. It's not enhanced security. It's just encrypting of input data, which basically disallows others that somehow manage to get a direct access from reading it. But that's not what happens on MAL. Here, users and mods get phished or keylogged, and a https can't do a thing about it.

Long story short, I'm always up for a secure protocol, but not in this case. The servers are so shitty that it would bring far more damage than profit, imho.

Mhm. This is true in most cases. And I agree that the encryption might be a little too taxing for these servers to handle.
However, I think you are downplaying just how easy it is to intercept someone else's traffic.

Say you are connected to an open network such as Starbucks wifi. Someone else at the local Starbucks can see all of your unencrypted traffic. This becomes an even bigger concern if, like most people, you are using the same password as you do with other online services. This could open you up to far bigger threats than just your MAL info.

That is a situation where HTTPS would be beneficial, and it's a pretty common one I think.

That said, I'm not so out of it so as to think anything is going to change. From what I've read this site seems to get little maintenance as it is. And yeah, as you mentioned, the servers might not be able to take it.

So... Moral of the story? If you're at Starbucks, stay away from MAL if you see a suspicious looking guy with a big beard and a laptop sitting across from you. Also, keep your own damned wifi secure. I hope that's a given.

We can dance if we want to.
Web Development and Programming: The sexiest place on earth

Jan 22, 2015 3:38 AM

#35

Offline

Jul 2018

564533

Hello,

Would it be possible to have HTTPS connections to MAL?

I do not like the idea of my password being sent as plain text over the internet and would much rather it be encrypted, I am sure many others would also prefer this.

This could be achieved by using a self cert or even a free certificate authority like https://cert.startcom.org/ in which MAL would be able to get a verified SSL cert without having to pay ridiculous amounts of money and the certificates are accepted by many browsers as well.

I know that we do not do any money transactions or anything like this but if your password is being sent as clear text over the web it does not take much for some one to nab it and considering many people use the same password for all there accounts online it would be quite simple to log onto other websites and do so. (me being a bit paranoid :P )

Jan 22, 2015 3:59 AM

#36

Subbed

Offline

Mar 2013

5831

I have to see just how better these new servers are after the move for my point of view to change.

Jan 22, 2015 5:49 AM

#37

Offline

Jul 2018

564533

Subpyro said:
I have to see just how better these new servers are after the move for my point of view to change.

It would only have to be when the user is sending there credentials, for the normal browsing around the site it is not needed. I would defiantly be happy even if it was just the login scripts that are HTTPS that way I know my password is not being sent as clear text across the web.

I do fully understand that HTTPS only encrypts the traffic between the two and that the user is still at risk to having key loggers and such however that is up to the user to sort there own machine out and keep themselves safe, like wise it is also key for the host to keep there servers safe. when it comes to sending data between the two it should be encrypted when it contains the clients personal data such as passwords.

Only having the login and log off done over HTTPS with 128-bit it would not add too much server load as most people click the remember me check box and then that's the end of it the rest of the site can just be as it is currently is.

Mar 23, 2015 10:41 AM

#38

Offline

Jul 2018

564533

Hey, i have been wondered about this a long time, i find MAL should implement SSL (Secure Socket Layer) to prevent man-in-the-middle attacks or any other similar attacks, it's not something that is often happening, however, it wouldn't also eat bandwidth usage (any extra), and nor does it cost much, somewhat a hundred dollar a year or so, and it will make all of our passwords SECURE! Many people here are using Passwords in MAL, on all other websites, lazy people use them over and over on almost all of the websites such as mail account, forums, etc dunno everything possible, i would say, it's a important security feature to be implemented, to secure our passwords. What's more scary is, what if our passwords are in the MAL's database as plain text? :O i guess it is (well... maybe). Also, SSL can prevent website's content being modified (somewhat rare case to happen), however, i find it a neccesary thing, it should be implemented like HB got, which will boost the overall quality of the MAL.

No SSL = Password's easily leaked to internet (if u got hacker in ur pc lol)

Folk, use VPN when ur gonna login to MAL from ur PC such as airport or any other places to prevent being hijacked :3

P.S: If my acc is hacked, and list is fully removed, then im too lazy to re-add all the anime i got (and im super lazy to create a backup, even if i know that it's just 3 mouse clicks away)

Mar 23, 2015 12:58 PM

#39

Offline

Oct 2009

7669

Excarius said:
and nor does it cost much, somewhat a hundred dollar a year or so

MAL would go broke

Excarius said:
P.S: If my acc is hacked, and list is fully removed, then im too lazy to re-add all the anime i got (and im super lazy to create a backup, even if i know that it's just 3 mouse clicks away)

You wasted more energy by typing this

Mar 23, 2015 2:02 PM

#40

Offline

Jul 2018

564533

Serhiyko said:

Excarius said:
and nor does it cost much, somewhat a hundred dollar a year or so

MAL would go broke

You wasted more energy by typing this

all ur posts i find them unnecesary
Why would mal go broke? I can afford 20$, and so does sure hundrefd of ppl that want. Please stop make pointless replies and let this thread die please.

Mar 24, 2015 1:25 PM

#41

http://myanimelist.net/modules.php?go=faq#donate

Offline

Oct 2009

7669

Excarius said:
Why would mal go broke? I can afford 20$, and so does sure hundrefd of ppl that want.

May 9, 2015 3:31 PM

#42

Tomasz-Sama

Offline

Jul 2013

279

I was just wondering if MAL will be supporting SSL ? At least it should be used for Login system as in the current state all the credentials and data is send via clear text over internet, I know it's just login system but it would prevent attackers from grabbing our credentials, what do you guys think about it ?

May 9, 2015 3:54 PM

#43

Akarin

Mahou☆Shoujo

Offline

Apr 2011

1276

It's the site about Japanese cartoons, nobody needs your account.

May 9, 2015 3:54 PM

#44

deg

Offline

Jan 2009

92877

as long as that Heartbleed bug or any other bug of SSL is gone then sure why not

May 9, 2015 4:17 PM

#45

Cnon

Offline

Oct 2014

3648

This is no banking site

May 9, 2015 9:06 PM

#46

BurntJelly

Offline

Feb 2013

6196

SSL should be forced for ALL pages, not just login. That way your session hash in the cookie will be encrypted too. Self-sign it for all I care, just use it.

I wonder how many more years it will be...

Jun 9, 2015 10:57 AM

#47

Offline

Jul 2018

564533

=== Topic merged after here for some reason ===========

Since most major sites are using https secure protocol (example: Google, Facebook, Twitter), I was thinking why MAL doesn't do that? http is just insecure, anyone who know these stuff can snoop packets, in my testing, I was able to to get cookies and etc. And there are probably lots of MAL users who share their network or are on public network like free public WiFi and etc, I think securing MAL with SSL is a MUST.

Even the api is insecure, it just uses basic access authentication, basically, base64 decoding the string will revel the username and password.

I don't know why MAL hasn't started using SSL/HTTPS in last 10 years but I personally would like to browse MAL securely and not worry about someone snooping my packets.

EDIT: Or TLS, whatever, better than nothing.

removed-userAug 20, 2015 5:25 AM

Jun 9, 2015 11:02 AM

#48

traed

Offline

Mar 2008

47073

Isnt TLS better than SSL ?

Jun 9, 2015 11:04 AM

#49