Https, our password are not private here :)

pierreozoux 2015-03-18 22:22:35 UTC #1

ntntntntn!

Not good
Startssl gives it for free! If you need help on that, please ping me

DanjaVasiliev 2015-04-18 20:12:11 UTC #2

Thanks for your attention!

as mentioned earlier, the lack of HTTPS was intentional - SSL as a centralized and hierarchic system conflicts with Superglue fight for distribution of the Web. We hoped the users will be taking care of their own privacy - the expectation wasn't met Soon we will implement HTTPS across web resources requiring authentication.

pierreozoux 2015-04-20 08:33:01 UTC #3

Yes, the PKI is centralised. And yes, I agree, this is bad.

IMHO, leaving your website insecure is worst. You could have a selfsigned certificate, but I think it is also really bad. The thing is that we deal with users that don't really understand what's going on. So we have to do our best to protect them. You can't assume that they'll know that their password will be insecure, and everybody online will know what pages they were visiting, just because there was no https.

Unfortunately, I don't have anything to offer to workaround the fact that https is centralised. I know it's tough, but that's life If you know some alternatives, I'd be interested