HTTPS for the forums/homepage

[rote7]

I am missing to possibility to use encrypted http to connect to the forums and the BGE homepage. We (have to) transmit sensitive login data to both pages. At least for the BGE homepage the login data is the same as ingame and can be used to snoop/change account details, cc numbers, make purchases etc. .

Especially when one has to connect from an untrusted environment (eg. public wlan) this will come in handy. Not everyone has his own VPN gateway to use.

Can we get a SSL Certificate for the forums and the BGE homepage? Thawte or verisign have resellers who sell certs at very reasonable prices.

[gtanner]

The account pages are https?

https://secure.wwiionline.com/scripts/wwiionline/user/login.jsps?redirect=%2Fscripts%2Fwwiionline%2Fuser%2Fprofile.jsps%3Fdo%3D&joomla=true

If you mean those ones.

[rote7]

Yes, they are. But the site logins for wwiionline.com and for the forums are not secured by https. As long as someone still can snoop userids and passwords from these connections it does not matter whether the account pages use enrypted connections or not.

[branko]

You could say the same of the sign-in to the game servers (via the game-client).

Technically there is no reason why this could not be done ... The certificate used for the Account Management Function/Pages should be able to be used to encrypt any pages in any of the sub-domains ...

However the account management system still operates in the "old" wwiionline domain (and this may be the reason that it does).

PM Bloo - In case the game-people do not pass on your message to him. That would at least get the ball rolling (or at least looked at).

[gigerman]

SSL is domain specific. If they are to secure a different domain, they will have to get a new SSL to cover it. Better choice is probably to get the account stuff under the same domain.

[Tigger6]

What gigerman said, it is not entirely trivial to set up SSL authentication for multiple virtual hosts.

[lure]

PLaynet security tip: If you unsub right away after you buy 1/3/6months or whatever plan you choose your CC info is cleared so even is someone have your login info they can't buy anything and have to enter new CC info.

[rote7]

You could say the same of the sign-in to the game servers (via the game-client).

IIRC the install of BGE contains the OpenSSL library. Thats why I always assumed that the playnet.exe sends the credentials over an encrypted connection, will check that tomorrow at work.