Use Secure HTTPS throughout this Forum and the Meteor Website

Question

This is not a "Bright Idea", this is a security flaw with the setup of this forum. When registering to use this forum you are asked for these personal sensitive pieces of information: - Password- Email Address- Mobile Number- CUSTOMER SERVICE PIN!- Age Confirmation This forum does not use secure HTTPS TLS anywhere, so when you register with this form, and when you login you are sending this information is clear plain text over the Web. This is extremely insecure especially considering (A) It's a known fact most typical users will use the same account password on multiple sites, so one should assume a user registering for this forum will use the same password that they use for the main MyMeteor account. (B) The Customer Service PIN is one of the pieces of information used when interacting with Meteor either by phone, chat, email, forum or post as a way to verify a persons credentials and valid identity.  So given (A) & (B) if a users password and/or PIN are intercepted on an insecure internet connection, the person gaining access to these credentials could use it to impersonate the customer when communicating with Meteor. The implications are obvious. When an attacker wants to gain access to customer details they will look for the weekest access link. This forum is one of the weekest access links and if comporimised or if user details are intercepted it gives the attacker all the information they need. This forum may be powered by the Lithium service, but it is Meteor's Technical team's responsibilty to setup and secure this forum adequetly. At the moment they have not done this. They are leaving customers at risk of identity theft and are failing in their obligations under Data Protection laws. This needs to be addressed immediatly. On a wider issue it is now considered good practice for public serving websites to use TLS throughout their website and not just for registration and login pages. Contrary to misconception using TLS throughout your site will not greatly reduce the speed or performance of the site if the sys admins have used correct modern server configurations, optimisations and TLS implementation. The major browsers are now blocking out non-secure elements on secure web pages and even Google is going to start using TLS as a signal for traffic ranking. So websites using TLS throughout their site will potentially get better search rankings on Google than those without. I would ask the Meteor Sys admins to at the very least seurce this forum with TLS and then role out TLS across their entire meteor.ie web properties and follow best practise. 

Answer 1

I have found that there is an SSL certificate installed on the server to cover the forums.meteor.ie domain, however it is not being enforced. Whilst not a perfect solution, for those using the EFF HTTPS Everywhere browser extension, I have written a ruleset that will force the browser to load https://forums.meteor.ie. I have submitted this ruleset to the EFF but you can also add the ruleset yourself with this following these directions, using this code: <ruleset name="Meteor.ie Community Forum">
<target host="forums.meteor.ie"/>
<rule from="^http://(www\.)?forums\.meteor\.ie/" to="https://forums.meteor.ie/"/>
</ruleset> Still waiting on an official response from Meteor.