Read-only archive

A preserved archive of the Logical Gamers community forums, 2009-2025. The original threads and posts, served read-only. Registration, posting and private messages are gone for good.

Gaia online now unsecured???

1.4k views · started by granturismo ·
#1
Gaia online now unsecured???
I'm on gaiaonline right now and i keep refreshing my internet browser and move to different parts of the site and apparently i keep still getting the slash throught the HTTPS. and the lock before it has an x on it.

go to this link for a picture of it.

http://tinypic.com/r/330bk39/7
#2
I don't remember Gaia ever fully supporting HTTPS.
#3
well they did it just looks like a regular HTTPs with nothing going through it or the lock saying secured website but the regular sites have just HTTP thats it but gaia right now has a slash through it and may be a breaking point for us to steal some stuff from it like account info or some other crap like that.
#4
I'm pretty sure the only way that makes a difference is if you can intercept someone logging into Gaia. Like Firesheep or whatever.

I thought so. It's never fully supported https. None of the links on the page are loaded via HTTPS. Clicking on any link will take you back to http://whatever vs https://whatever.

#5
true but it was regularly not like this like it is now.
#7
The most likely scenario is that they're attempting to load a non-secure image/css/js file. i.e. from https:// they're attempting to load a resource using the http:// protocol. I guess, technically, it is a bit of a concern, as someone monitoring your network would be able to retrieve the session id stored in a cookie sent with the request. However, I would be very surprised if the login system system went from https -> http, so your username and password should be safe.

It's only really an issue if you're on an open or insecure network.
#8
Artificial wrote:
The most likely scenario is that they're attempting to load a non-secure image/css/js file. i.e. from https:// they're attempting to load a resource using the http:// protocol. I guess, technically, it is a bit of a concern, as someone monitoring your network would be able to retrieve the session id stored in a cookie sent with the request. However, I would be very surprised if the login system system went from https -> http, so your username and password should be safe.

It's only really an issue if you're on an open or insecure network.

https://gaiaonline.com/auth/login actually does contain a form that submits to http://gaiaonline.com/auth/login and all links on pages loaded with https:// actually lead to unsecured pages.
#9
agreed but lets find out why xD
#10
granturismo wrote:
agreed but lets find out why xD

The reason is that Gaia never set it up for HTTPS properly. It's been this way for ages.
When you run a website, if you want to support people connecting via HTTPS, you have to set it up for that.
#11
ohh so thats why its so easy to hack them xD