Recommended Posts

I was going to say. There's dozens of certified signing authorities that do SSL cert pricing for reasonable money O.o

Comodo will sign a multi-domain cert through namecheap for $91..

http://www.namecheap.com/ssl-certificates/comodo.aspx

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

I think Neobond merely misinterpreted the first post, as not having SSL is something we've discussed in the past (as shown by the link in my previous post)

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

Ook? Ook. Ook! Ook! (sorry, can't resist.. :p )

On topic, how about setting up a donation page? Then annoy the hell out of your users, a'la Wikipedia?

Or at least have optional secure login using self-signed cert for those worried about sniffing but not too bothered with an extra browser warning?

Don't worry about it :)

My poke wasn't directed at Neowin (staff), it was towards the fact that for the most part the folks that use Neowin are technologically savvy individuals and someone was just coming across this now (Or so it was believed before Dave posted the old thread). When you quoted the length of time, it literally made me laugh. I just found it ironic.

I think Neobond merely misinterpreted the first post, as not having SSL is something we've discussed in the past (as shown by the link in my previous post)

I'm chalking it up to early money brain cloud (for those of you just waking up) and late night brain cloud (for those like me who are just about to come off a 12 hour overnight shift) ;)

Ook? Ook. Ook! Ook! (sorry, can't resist.. :p )

Lol :p

As for the issue, I don't really think it's that big of a deal.

My poke wasn't directed at Neowin (staff), it was towards the fact that for the most part the folks that use Neowin are technologically savvy individuals and someone was just coming across this now (Or so it was believed before Dave posted the old thread). When you quoted the length of time, it literally made me laugh. I just found it ironic.

I'm chalking it up to early money brain cloud (for those of you just waking up) and late night brain cloud (for those like me who are just about to come off a 12 hour overnight shift) ;)

I had just woke up (was on first coffee) :p

  • Like 4

The way I see it, a lot of people use the same passwords for different sites.

I'm pretty sure people do it here.

It's all well in saying use a different password etc etc. but standard users won't do that.

So for a small fee of an SSL cert. I'm sure we could do a whip around and get the cash raised pretty easliy. I'll donate a few dollars no problem :-)

To me sites need to protect the user, just as much as the user needs to protect themselves.

Even if the info isn't that important, some of the stuff could be used for social engineering attacks.

There was a previous discussion about this here: http://www.neowin.ne...ds-https-login/

Not bad. It's ONLY been 7 years since that topic was started!!

Neowin is right on top of it. Certs ARE NOT that expensice now a days, as has already been pointed out, but with all the issues this site has every time they update the board, certs would only screw it up more, I'm sure! :rofl:

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

	<form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

post-14624-0-50929000-1361862547.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Off-topic a bit, but how did you do that? I'd like to test a few sites

So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.

you'd think the fact that the passwords are stored in clear text would be the real worry here.

How many people's clear text passwords could someone steal by hacking the neowin database. but at least neowin is secure and always running the latest up to date IPB version so there should be no worries of that... ;) :p

So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.

you'd think the fact that the passwords are stored in clear text would be the real worry here.

How many people's clear text passwords could someone steal by hacking the neowin database. but at least neowin is secure and always running the latest up to date IPB version so there should be no worries of that... ;) :p

Erm, except it's not US sending cleartext passwords, it is the person logging in sending a password that could be sniffed with a keylogger or something. Our member passwords are encrypted/hashed/salted on our servers.

This needs to be sorted , every other day sites and people get hacked this is not helping , if neowin gets hacked how many 1000s of people details will be lost.

I know this is just you to the server problem.

As I already pointed out, nothing about your password is stored on our servers as plain text, What YOU send however could be picked up by network sniffing, just like someone could steal your phone and then call any of your contacts on it (if the phone was unlocked).

  • Like 1

As I already pointed out, nothing about your password is stored on our servers as plain text, What YOU send however could be picked up by network sniffing, just like someone could steal your phone and then call any of your contacts on it (if the phone was unlocked).

After i read your post above i edited my post , sorry for not reading the whole thread before i posted.

We already have a donations page. Except we don't call those people donors, we call them subscribers. ;)

Some people might 'donate' more if they know the money will be going towards certificate signing. I, for one, would.

But looking at the comments here, this seems unlikely to happen..

Or secure yourself and sign in using Facebook or Twitter. As an added bonus you only need to sign in once and you can log in to many sites without having to enter anything at all.

But I agree, logging in should really go over SSL. Certificate cost shouldn't be a problem, RapidSSL's certificates are perfectly fine and trusted in all browsers and operating systems and only cost $49 for neowin.net or $199 for *.neowin.net. That shouldn't be too hard.

Your password can't just get sniffed on your computer but on any public network you connect to. When our school's WiFi wasn't secured we could sniff hundreds of passwords in a few minutes by just launching a Firefox plugin. You can't completely secure yourself as a user, but when Neowin decides to let logins go over SSL you are perfectly fine.

It's 2013 now, we've come to a point where even regular Google searches happen over SSL. Any site where you can only login over an unencrypted connection should be banned from the internet.

  • Like 4

To be honest, I do find it funny that it has not come up since that 2006 thread. To be honest, I was in the middle of posting how a site does not have to be fully https to have a secure login in that other thread.. I was quite sure that neowin would be doing the best practice thing of using https for the login portion.

But as always - better check your facts.. And figured I would use the code as example of how its done, etc..

So is this something that is going to be fixed? Could not seem to tell which way this is going.. Now back in 2006 the likely hood of wifi sniff was a lot less, not everyone was on a tablet surfing the web whenever and wherever, etc.. But as mentioned, in 2013 there is a browser addon to gather such info ;)

I normally don't like using fb or twitter logins - but if they are secure I might have to switch. Is there a actual openid method of logging in?

Erm, except it's not US sending cleartext passwords, it is the person logging in sending a password that could be sniffed with a keylogger or something. Our member passwords are encrypted/hashed/salted on our servers.

So it's the USERS fault that your login page doesn't pre-encrypted/hashed before being sent, or using SSL.

a keylogger is kind of invalid argument since at that point your computer is already fully compromised and it doesn't matter where it's encrypted unless you have a keyboard with a TPM chip that encrypts the password before the computer sees it, which is kind of unreasonable and besides the point :)

point is the password can be hashed client side before they're sent without "expensive" SSL certs.

As it is, even if they're not stored as clear text, someone could inject bad code to your site, and have all the cleartext passwords sent to you every day passed on .

This topic is now closed to further replies.
  • Posts

    • Why it's almost impossible to produce a smartphone in the United States by Hamid Ganji If you look at the back of some Apple products, you can see the famous phrase “Designed by Apple in California, Assembled in China.” This phrase appears on products from one of the largest smartphone brands in the United States. These products are designed in the U.S., but their manufacturing takes place in China, India, Vietnam, or even Brazil. But why can’t Apple, as one of the largest American tech companies, produce its iPhones on U.S. soil? The idea for this topic came to me after the Trump Foundation launched a smartphone called the T1 and claimed that it was designed and built with American values in mind. However, this claim did not last long, as it was revealed that Trump’s phone was actually a rebranded HTC U24 Pro, with only a gold case and minor internal component changes. You see? Even a phone that is supposed to represent American values is manufactured in China. With a gross domestic product (GDP) exceeding $32 trillion, the United States is currently the world’s largest economy, while China ranks second with around $20 trillion. On the other hand, the United States is by a wide margin the global leader in various technological fields, and American companies spend hundreds of billions of dollars annually on research and development. From Apple and Google to Microsoft, Lockheed Martin, Boeing, and others, American tech and industrial giants lead their foreign competitors in many sectors. The United States also has no shortage of smartphone brands. Apple, Google, and Motorola are among the major brands in the smartphone market, collectively holding a significant share. However, the vast majority of their products are manufactured outside the United States. So why is it that the world’s largest economy, home to the most advanced technology companies and industrial powers, cannot produce a smartphone on its own soil? Let’s explore this question together. Even threats to impose tariffs won’t work After Trump entered the White House as the 47th President of the United States, his administration adopted strict tariff policies. One of these policies was the imposition of a 25% tariff on smartphones manufactured outside the United States. Trump said he “had a little problem” with Apple CEO Tim Cook over producing smartphones outside the U.S. So he thought that threatening a 25% tax on imported phones might force Apple to bring manufacturing back to the United States. “I have long ago informed Tim Cook of Apple that I expect their iPhones that will be sold in the United States of America will be manufactured and built in the United States, not India, or anyplace else,” Trump wrote on Truth Social. Image via The White House Although Apple currently manufactures some of the iPhone’s chips in the United States with TSMC's help, it still shows no willingness to shift full iPhone production to the country. At the time, renowned Apple supply chain analyst Ming-Chi Kuo wrote on X, “In terms of profitability, it’s way better for Apple to take the hit of a 25% tariff on iPhones sold in the US market than to move iPhone assembly lines back to the US.” However, manufacturing a smartphone in the United States is not as easy as it might seem, and many technical and economic barriers are involved. The lack of necessary manufacturing hubs There is a clear reason why many companies prefer to manufacture their products in China. China has established itself as the main global manufacturing hub for international companies, and over the past few decades, large contract manufacturers have emerged there, allowing companies like Apple to outsource production. One such example is Foxconn, which also manufactures some Apple products in India. Building the infrastructure required to produce smartphones in the United States would require tens of billions of dollars in new investment. Factories would need to be built, essential manufacturing equipment would have to be installed, and, most importantly, a skilled workforce capable of operating these systems would need to be recruited and trained. The United States currently lacks the core infrastructure needed to manufacture smartphones, and for this reason, many companies prefer to outsource production to Chinese contractors rather than spend tens of billions of dollars to build that infrastructure, which is significantly more economically efficient. Additionally, building such infrastructure in the United States could take up to a decade, ultimately leading to a significant increase in the product's final price for consumers. Shortage of trained labor in the U.S. compared to China Decades of serving as a global manufacturing hub have allowed China to build a massive talent pool in the production sector that is almost unmatched worldwide. Today, if a company chooses to manufacture its products in China, it can be confident that the workers involved in production have years of experience in their respective roles and are capable of producing high-quality goods with minimal errors. Even if we assume that tens of billions of dollars were invested in building smartphone manufacturing infrastructure in the United States, finding skilled workers would remain highly challenging. Apple CEO Tim Cook visiting the iPhone 6 assembly line in China in 2014. Image: Tim Cook on X In a 2015 interview on CBS’s 60 Minutes, Tim Cook said the main reason Apple isn’t producing in the US is a lack of skills. "China put an enormous focus on manufacturing, in what you and I would call vocational kind of skills. The US over time began to stop having as many vocational kinds of skills. I mean you could take every tool and die maker in the United States and probably put them in the room that we're currently sitting in. In China you would have to have multiple football fields,” Cook said. Also, in 2017, at the Fortune Global Forum in Guangzhou, Cook once again emphasized the importance of highly skilled Chinese workers. “China has moved into very advanced manufacturing, so you find in China the intersection of craftsman kind of skill, and sophisticated robotics and the computer science world. That intersection, which is very rare to find anywhere, that kind of skill, is very important to our business because of the precision and quality level that we like. The thing that most people focus on if they’re a foreigner coming to China is the size of the market, and obviously, it’s the biggest market in the world in so many areas. But for us, the number one attraction is the quality of the people,” Apple CEO said. Higher labor costs in the United States Producing almost any product in the United States is more expensive than in many other countries, and one of the main reasons is the higher cost of labor in the U.S. According to the Bureau of Labor Statistics, median weekly earnings of full-time workers in the United States were $1,235 in the first quarter of 2026. Meanwhile, the average annual salary in China's private sector in 2025 was RMB 71,590 (US$9,961). In many parts of the world, the weekly wage of an American worker is equivalent to several months of income. Another important factor to consider is that in the United States, the workforce capable of working on a smartphone assembly line is highly specialized and therefore commands higher-than-average wages. According to an estimate by Bank of America, producing an iPhone in the U.S. is technically possible, but “iPhone cost can increase 25% purely on higher labor cost in the U.S.” However, this 25% increase applies only if final assembly is performed in the United States while components are still sourced from China or elsewhere. In this case, the price of a base iPhone would rise from $799 to around $1,000. But in another scenario, if Apple were to produce the required components for the iPhone within the United States, production costs could increase by more than 90%. Trump’s dream for a “Made in the USA” iPhone might never come true In a free-market capitalist economy, one of the primary responsibilities of any CEO is to maximize profit. Using Apple as an example, Tim Cook’s role is to maximize the company’s profits so that it can fund research and development for new products and invest in areas such as artificial intelligence, while also keeping shareholders satisfied. Therefore, it is entirely understandable that Apple would choose not to bring its manufacturing back to the United States and instead keep production in countries where labor is cheaper, and products can be manufactured at a lower cost, thereby maximizing its profit margins. What is your opinion about manufacturing smartphones in the United States? If you are an American citizen, would you be willing to pay hundreds of dollars more for a smartphone made domestically in the USA? Let us know in the comments.
    • Cheers everyone for the replies. It's been very useful. 👍
    • Compared to the 7735HS it is around 25-30% slower in multi-threaded tasks (according to Google search) I did a review of the 7735HS Beelink SER6 Max in 2023, but thinking about it, it's not comparable to the 7730U. For the example you gave about how it will be used, the 7730U is actually an excellent choice for its power and battery efficiency.
  • Recent Achievements

    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
    • Week One Done
      Woland13 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      194
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      72
    5. 5
      FloatingFatMan
      67
  • Tell a friend

    Love Neowin? Tell a friend!