Tiltforums doesnât use https so that message is normal.
Chrome is (intentionally) becoming more aggressive about calling out sites that donât use HTTPS. I believe Google also plans to demote non-HTTPS sites in search rankings, if theyâre not already doing so.
1 Like
1 Like
From iOS, it is no longer possible to sign into the forum because Safari (rightly) refuses to send a password over an insecure connection.
It would be really nice to get https enabled for the site.
5 Likes
I sign in just fine via Safari on my ipad. Donât even get a warning. Might want to check your settings.
2 Likes
Weird. I just tried again from my iPhone, and it works now. There is a big fat red warning at the top though âInsecure siteâ.
I vaguely remember seeing a similar issue caused by my password manager refusing to fill a non-https site.
Just want to point out Iâm seeing it on Firefox too. I get a warning each time I log in.
On Chrome, but browser needs updating.
The site uses HTTP for now. Whether youâre getting a warning or not makes no difference. Nothing has changed here. Your browser is now telling you.
If youâre practicing good browsing habits the use of HTTP here should be of little concern.
The IFPA site slightly more risky if youâre a TD. But they have a different issue, I think Firefox doesnât like something about the certificate theyâre using.
Arguably a lot has changed in recent years. Plaintext http MITM attacks have never been easier for anyone from the curious kid down the hall to your ISP or even organized crime. It isnât difficult to find ready to go images for cheap devices like an RPi that will do most of the heavy lifting, and enable delivery of things like relatively benign advertisements, slightly less benign crypto-currency mining javascript, or other outright malicious code.
Pervasive use of HTTPS (and additionally of the HSTS header to prevent browsers from ever using plain old HTTP to begin with) goes a long way to stopping these attacks.
As for the IFPA site, theyâve only obtained a cert for www.ifpapinball.com and havenât requested ifpapinball.com as an alternate domain in whatever theyâre using as a Letâs Encrypt client. If you always use www when browsing, it should work fine.
4 Likes
ifpapinball.com has been serving random ad pages intermittently for the past few days. Iâve seen it twice, and several mates of mine also report getting ad pages every now and then.
1 Like
My junk email folder was blank for a few months now Iâm getting 5-12 junk emails a day. Wonder if this is related.
It is not
10 Likes
Of course TLS makes it all the more secure! 
I freely admin I have been super lazy about getting this setup. Its going to take a bit of work on my part but Iâll try and get to it soon.
2 Likes
Unsure if itâs related but Iâve been noticing lately that I occasionally will need to login twice.
Now I get this multiple times before the site loads. 
Just bumping this. Canât hurt to do that once a year.
3 Likes
Earlier today I noticed a brief âloadingâŚâ splash while using a cafeâs wifi and immediately thought they (or someone else on the network) were doing man-in-the-middle shenanigans like hotels used to do. Saw the splash again when I got home, so I assume itâs a legit update to the site instead.
It sure would be nice if that concern were mitigated by tls thoughâŚ