DegreeForum security

[ashkir]

Hi there. Who do we contact about the degree forum security? On the login page there’s a non secured item that loads that compromised the lock.

[rachel83az]

You could try using the contact form here: https://www.degreeforum.net/mybb/contact.php

[jch]

Unfortunately, degreeforum.net defaults to plain HTTP for pages and content. Sometimes this gives the annoying insecure content issue you describe. Worse, they haven't set the secure flag on session cookies. You may be able to work around this in your browser. Some web browsers, including Chrome, allow you to manually force domains to use HTTPS all the time. Everything on degreeforum.net that I've found works just fine with HTTPS, someone just needs to set that to be the default.

If you're using Chrome, open a new tab to chrome://net-internals/#hsts
At the top, under "Add HSTS domain", enter degreeforum.net, check the box to include subdomains, and click add. This adds the domain to Chrome's HTTP Strict Transport Security list - instructing the browser to always use HTTPS.

[Merlin]

Unfortunately, degreeforum.net defaults to plain HTTP for pages and content. Sometimes this gives the annoying insecure content issue you describe. Worse, they haven't set the secure flag on session cookies. You may be able to work around this in your browser. Some web browsers, including Chrome, allow you to manually force domains to use HTTPS all the time. Everything on degreeforum.net that I've found works just fine with HTTPS, someone just needs to set that to be the default.  

If you're using Chrome, open a new tab to chrome://net-internals/#hsts
At the top, under "Add HSTS domain", enter degreeforum.net, check the box to include subdomains, and click add. This adds the domain to Chrome's HTTP Strict Transport Security list - instructing the browser to always use HTTPS.

Or you can just install an extension called "HTTPS Everywhere". That is what I use, and it automatically enables HTTPS on every site that will support it (though you can configure stuff on a site-by-site basis as well), so I have never seen that message.

My guess is that using HTTP for pages and content is just a means to reduce CPU load on the webserver. I bet it is the default for the MyBB forum software itself.