This forums security.

By Aminar, in X-Wing

Has anybody else had Chrome sporadically blocking this site as a dangerous place on the internet?

Anybody know why?

It's getting frustrating.

Thanks

Every now and then when I come to the forum, the "most recent" posts are all some spam in Chinese. Haven't seen the forum blocked yet, though.

It IS dangerous. It's done nothing but encourage me to keep buying ships.

No, and I have been using Chrome.

Has anybody else had Chrome sporadically blocking this site as a dangerous place on the internet?

Anybody know why?

It's getting frustrating.

Thanks

I have Chrome, and it has not done that to me.

Do you have Adblocker? I recommend it if you do not.

With Dolphin Browser on my phone also happens from time to time.

I had something similar happen with mercury on my iPad several times right after the web site was updated. It kept asking if I wanted to allow...something. Eventually I said yes and it stopped happening.

The site makes chrome on my phone claw at the walls and spit pea soup. Someone said it was in the internet protocol. I dunno, but it would be nice if that got sorted.

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

Unplug it, wait fifteen seconds, and plug it back in.

Edited by TopHatGorilla

I always use Chrome and have had no problems,

Chrome on desktops doesn't seem to have any issues, but mobile devices don't seem thrilled. Hope it gets resolved soon, although my productivity probably increases while I'm at work with only a phone to browse.

Every night the last 3 nights... rather irritating.

On my mobile device I should add...

Edited by oneway

Has anybody else had Chrome sporadically blocking this site as a dangerous place on the internet?

Anybody know why?

It's getting frustrating.

Thanks

You're using Chrome - That's your problem!!! ;)

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

The certificate issue and the spam issue are separate.

Simplifying a lot: when a site uses https:// the traffic between your browser and the web server is encrypted in such a way that only the web server can decode it. This solves the problem of someone along the way copying down your traffic and figuring out what you're doing on that site (snooping your purchases, or your private messages, etc.). Without that, it's like if someone looks over your shoulder at the ATM; an eavesdropper could roll up to the bank and be all "yeah, I'm totally that guy; I know his PIN" and then take all your money, etc.

However, this doesn't solve the problem of your browser being lied to about who it's actually talking to. If you think you're talking to your bank, but you're actually talking to a Russian scammer, it doesn't matter if nobody else knows what you're whispering to the Russian, he's still going to make off with all your money after you leave, by going to the real bank and being all "Ja, ve iz him; I hav PIN." (Sorry to any actual Russians reading; I've been watching too much Daredevil lately)

"Certificates" can solve both problems. The technical implementation doesn't actually work this way, but think of certificates as a phone book that your browser can look at to determine the addresses of all of your bank's actual locations. When your browser shows up at 123 Bank Street, it checks the cert, says "yep! this is totally a legit branch of The Bank" and you go about your business.

If you show up to 666 Russian Way, your browser freaks out and says "Dude, this looks shady, 666 Russian Way isn't on the list" and so you leave and your money doesn't get stolen.

The issue here is that FFG's done some remodeling and has a new branch office at 127 Bank Street, but hasn't updated the phone book. Whenever your browser wanders over there instead of the original 123 Bank Street location, it freaks out about the Russians and throws up that certificate warning page. They really should fix it, since getting people used to ignoring those warnings is bad, since it gets people used to believing "No, iz no scam, iz Bank!"

Lol chrome

Without the specific error it's hard to say. My desktop chrome connects with https but reports the following warning when I look into it further:

"However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page."
Maybe that mobile version of Chrome is way more sensitive to insecure content within an https page. Would need what URL you're getting and what the exact error is to know more, and then it's probably best to send it to whomever is the admin of the site to deal with.
EDIT: Or see WickedGreys post for a better answer :D
Edited by avaktor

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

Unplug it, wait fifteen seconds, and plug it back in.

"Haveyoutriedturningitoffandonagain?"

"Wot?"

"Haveyoutriedturningitoffandonagain?"

"Wot?"
"Have you tried. turning it off. and on again!"

I just won 100 quid!

Yep. My desktop has no issues, but my Android phone keeps wanting me to verify the certificate.

It happens because people don't know how to use an apostrophe.

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

The certificate issue and the spam issue are separate.

Yeah, someone was explaining to me that the hackers/bots may have gained admin access to the entire site through a backdoor. I don't know if this would have required a successful attack on the SHA1 hash, or if it would have been through a different entry vector. IT security is not my field, so I don't know.

Chrome is reacting badly because the cert is SHA1 hashed and that is obsolete - the latest versions of Chrome have been updated to call out 'bad' certs -

http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html

That makes sense and is the simplest explanation.

I have this issue almost 100% of the time on my phone, but like a good IT professional I blatantly ignore the warning and do whatever I **** well please. In this case that's spend a whole lot of time on these boards.

Their certificate is corrupted. This bots use this to get in. Some other users more well versed in IT could explain it better.

The certificate issue and the spam issue are separate.

Yeah, someone was explaining to me that the hackers/bots may have gained admin access to the entire site through a backdoor. I don't know if this would have required a successful attack on the SHA1 hash, or if it would have been through a different entry vector. IT security is not my field, so I don't know.

That's unlikely; far more probable is that either someone wrote a script that automates signing up for an account here, or someone's paying a Chinese sweatshop $0.25 per valid forum account. It's difficult to tell the difference between a spammer and a fresh Star Wars nerd before they start posting.

Chrome is reacting badly because the cert is SHA1 hashed and that is obsolete - the latest versions of Chrome have been updated to call out 'bad' certs -

http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html

Ah, okay. The problem's changed since I dug into it last (see, this is why getting in the habit of ignoring warnings is bad!).

I have this issue almost 100% of the time on my phone, but like a good IT professional I blatantly ignore the warning and do whatever I **** well please. In this case that's spend a whole lot of time on these boards.

"Iz Bank!"