Recommended Posts

You wouldn`t need anything like EV-SSL, simple DV would easily suffice for what is required. For me a site like Neowin should be actively encouraging this type of practise, it writes about it enough on the front pages. I`m not saying that our passwords for this forum are something that a MITM attacker would necessarily wan`t just that if it helps spread the usage of such methods and brings awareness to the issues then surely that`s a good thing.

No it's not. I've listed to all 392 episodes of Security now, and the answer of

"I login to Neowin at home, then when I'm on the road with my laptop, I'm already logged in, so no real issue of transmitting my credentials over wifi in clear text."

would make them shake their heads. No hard feelings!

It's not an excuse, merely a commentary on a (probably) normal usage pattern of the website.

BudMan, you are correct, cookies for the session info etc are still sent in plain text, but this is something that happens with many websites. For example, the default on Facebook is to login via https, and then use unencrypted http for the rest of the session, but they have an option to force https for the whole session if you wish.

"but they have an option to force https for the whole session if you wish."

Is this something that might be an option once the SSL cert is obtained? I really don't think such a site as neowin requires such action, and could be unwarranted strain on the servers in general. But might be a nice option for those more security minded users.

I do believe it would be possible to implement some current security practices without too much effort on the developers part and min extra work for the servers and cost, etc. It would be good thing for neowin to lead by example in the field and quite possible to show how neowin is ahead of the curve when it comes to security compared to other such sites.

edit: Maybe the whole site https option could be an option for subscribers only, etc. This might get a few more to join that rank and help neowin offset any added cost in such an implementation?

More worried about local wifi sniffers, that quite often could be kids just out for some lulz, etc. Now those can be mitigated with a secure connection across the open wifi like vpn or ssh tunnel for browser traffic, etc. But if best practices where followed, the login info would be secure anyway - which would reduce the risk of some kids out for some fun using a browser addon and simple wifi sniff. Again I am not too worried about someone sniffing my traffic while at home or work, etc. Or place of business that has a secure wifi connection.

Your worries are right but I'm afraid it isn't just as easy as securing the connection, adding server certificates. There are network flaws which simply can't be fixed, this is because of the RFC's related to the OSI Stack.

A hacker could join onto a public hotspot and essentially hijack all the popular websites he'll see results on. This could be Facebook, Amazon, Best Buy whatever. These websites will all have SSL certs, security measures in place. When he hijacks a website, the SSL certificate is in-tact (if done properly) and everything should appear fine, again if done properly. The hacker will still take logins, credit-card details. There's just nothing you can do. Even a security minded individual would have trouble spotting it. I wouldn't know.

So in terms of Neowin being secure, I know IPB is very good in that area. Regarding SSL, it wouldn't even be necessary. For the guys, it would more so be there just to make the people visiting feel happy.

Also, to reflect on the hacking technique I mentioned above, this would have to be planned and developed with quite a bit of time and effort. I wouldn't worry about joining your local Starbucks wifi anytime soon.

Just wanted to say that for those saying "its just a forum" what about the fact some people link their twitter

if you posted a status update on the forum and said "post to twitter also" (which is an option" then you could post tweets to someone elses twitter!

"but they have an option to force https for the whole session if you wish."

Is this something that might be an option once the SSL cert is obtained? I really don't think such a site as neowin requires such action, and could be unwarranted strain on the servers in general. But might be a nice option for those more security minded users.

I do believe it would be possible to implement some current security practices without too much effort on the developers part and min extra work for the servers and cost, etc. It would be good thing for neowin to lead by example in the field and quite possible to show how neowin is ahead of the curve when it comes to security compared to other such sites.

It's something we'll look into, we'll have to measure the extra load that it puts on the servers and judge if that is something we're able to cope with.

In terms of back-end security, the way we prevent malicious scripts from being uploaded and executed, I think we're pretty strong, we used to have issues with flaws in IPB that would allow scripts to be uploaded as attachments, and then accessed by the malicious user to run commands on the servers, and do all kinds of things. Now even if IPB still has those flaws, the scripts won't work. We also have code in place that ensures that none of our files have been modified by anyone other than our devs.

I think a sophisticated mitm attack such as what your talking about is way beyond the scope of the original point of this topic.

Not saying such an attack is not possible, but just because sophisticated attacks are possible does not remove the responsibility of due diligence in providing protection against less complex attacks, etc.

Lets take some baby steps, and methods that would be required for neowin to mitigate such attacks would have no justification in cost in time/effort and support by the users in using methods and practices that prevent or identify such an attack. Now if neowin was where I did my banking, it might be a different story ;)

edit: I am very happy with the staff response to the query, and satisfied that after the upgrade this practice will change. If not, I will be sure to remind them of this thread ;) hehehe

I think a sophisticated mitm attack such as what your talking about is way beyond the scope of the original point of this topic.

Not saying such an attack is not possible, but just because sophisticated attacks are possible does not remove the responsibility of due diligence in providing protection against less complex attacks, etc.

Lets take some baby steps, and methods that would be required for neowin to mitigate such attacks would have no justification in cost in time/effort and support by the users in using methods and practices that prevent or identify such an attack. Now if neowin was where I did my banking, it might be a different story ;)

If Neowin was hackable easily, it would of been done by now.

Less complex attacks like sniffing on a public wifi spot use the same flaws I mentioned for the attacks above, just looked at in a different manner. The bad thing is about security is that the best security engineers are the ones who used to be hackers.

I'd like to point out just for the sake of Neowin. The discussion topic is not a FLAW. Its simply a understanding of how these processes work.

"If Neowin was hackable easily, it would of been done by now."

I am not saying that neowin is hackable because they don't secure the transmission of the uses login info. What I wanted to point out, that in this day an age there is little reason to send such info in the clear.

I was surprised that it was to be honest. Now I just checked on another forum site I frequent, and they are doing the same sort of thing posting such info via http vs https. But their code is hashing the password before transmission, not a great solution for many reasons already mentioned. But they too have a thread where someone (not me) brought up the oversite. They have responded that after the upgrade to new version of their forum software they would be making the change to https in the posting of such info as well.

I am not trying to say that neowin dropped the ball in anyway shape or form, many many sites do the same thing. Not saying that neowin is not a secure site, just wanted some clarification to what was pointed out to me, and I verified was happening.

Again I have been very happy with the response from the staff, and in general it's not really that big of an issue taking into account the nature of the site, etc. But it sure couldn't hurt to encrypt such info, and then maybe tackle the session cookies in the clear issue ;)

"If Neowin was hackable easily, it would of been done by now."

I am not saying that neowin is hackable because they don't secure the transmission of the uses login info. What I wanted to point out, that in this day an age there is little reason to send such info in the clear.

I was surprised that it was to be honest. Now I just checked on another forum site I frequent, and they are doing the same sort of thing posting such info via http vs https. But their code is hashing the password before transmission, not a great solution for many reasons already mentioned. But they too have a thread where someone (not me) brought up the oversite. They have responded that after the upgrade to new version of their forum software they would be making the change to https in the posting of such info as well.

I am not trying to say that neowin dropped the ball in anyway shape or form, many many sites do the same thing. Not saying that neowin is not a secure site, just wanted some clarification to what was pointed out to me, and I verified was happening.

Again I have been very happy with the response from the staff, and in general it's not really that big of an issue taking into account the nature of the site, etc. But it sure couldn't hurt to encrypt such info, and then maybe tackle the session cookies in the clear issue ;)

Oh yeah, I definitely agree with you. Sorry, we've been bouncing back and forward ha.

SSL should definitely be implemented. Its just in good nature that one of the largest tech forums/news sites incorporates it. My point was, if you did this it still wouldn't make the password secure.

Regarding local encryption with vBulletin, all it is, is a md5 function. Once retrieved you can just pop it in one of many md5 decrypts on the internet. Hopefully it then re-hash's that password. If it just takes the md5 from the client, then uses a salt to encrypt then thats less secure because you can retrieve the md5 hash before its salted.

Just goes on and on...

Also - I did not mean to open a can of worms here, as mentioned multiple times -- this is just a forum and really nothing should be here that is of a critical nature to ones privacy or security. But even in this day and age, some users continue to use bad passwords, same password on multiple sites. I would not be surprised if some users here use the same password they use for their registered email account with neowin as their email password, and shutter to think even their banking websites, etc.

That really isn't true. How many users here link their facebook/skype/im/personal websites to their user profiles. I am guessing quite a bit. If the site were to be compromised then there is a chance that this information could be gotten also.

"if you did this it still wouldn't make the password secure."

It would be much more secure than the current clear text method of sending it :rofl:

But yeah I agree with you method of transmission does not always mean its "secure" For all we know 87% of users passwords here on neowin are "P@55w0rd1" And if someone wanted they could just pick a user at random and try a couple of common passwords and get in to those accounts.

I wonder what neobonds password is? You going to be at starbucks or something sometime soon? ;)

I don't see a major issue here? your password you send to the server is always unencrypted and that's the way it is, HTTPS does make things more secure though because it stops people sniffing around to get that password but I think you'd have to be pretty unlucky to have that happen to you anyway.

Comodo is the cheapest way to get an SSL Certificate and does work on most browsers, but obviously the real good ones like Verisign cost a lot of money. The cost of a Verisign Certificate could actually be used for an extra server at neowin to improve speed loads its that expensive..

this. isn't. a. banking. website. get a grip people.

What if someone got your password and logged in and went to your neowin profile editor to steal your email address then log out... so he/she can send spams using your email address?

Think about it... I agree and understand what Budman have said about the concerns over logins.

clear text based login is a NO NO. I am surprised that Neowin didn't do a thing about it until Budman brought it up.

So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.

Because its useless. All it does is transform you password into another form. The attacker can just send your pw hash as your password. Bam you're into the account. The only useful thing it does is prevent the attacker using the hash on another website that uses a different hash algorithm or no hashes.

just because for some reason web hosts have fanboys, and because GoDaddy is so huge they have a lot of haters for some reason.

Well, that and their customer support blows *** and their administration site looks like it was designed by a 12 year old, but otherwise I guess they're fine.

just because for some reason web hosts have fanboys, and because GoDaddy is so huge they have a lot of haters for some reason.

In the last few years, GoDaddy has come under fire plenty of times ? and for plenty of reasons.

Not only has the company used sexual advertising several times to promote its services, which has led to backlash several times, but in early 2011 then-CEO Bob Parsons killed a wild elephant in Zimbabwe, which many believed was just another sign that the company was willing to engage in unethical practices. (This includes buying domain names users search for and then inflating the value of these domains when users return to purchase them so GoDaddy makes a larger profit on the transaction.)

In late 2011, GoDaddy also initially supported SOPA, which also indicated the company was not willing to support its customers freedom of speech and activity on the internet. (GoDaddy reversed their opinion shortly after a call to boycott the company because of this.)

Seems like enough reasons to me.

This topic is now closed to further replies.
  • Posts

    • Why it's almost impossible to produce a smartphone in the United States by Hamid Ganji If you look at the back of some Apple products, you can see the famous phrase “Designed by Apple in California, Assembled in China.” This phrase appears on products from one of the largest smartphone brands in the United States. These products are designed in the U.S., but their manufacturing takes place in China, India, Vietnam, or even Brazil. But why can’t Apple, as one of the largest American tech companies, produce its iPhones on U.S. soil? The idea for this topic came to me after the Trump Foundation launched a smartphone called the T1 and claimed that it was designed and built with American values in mind. However, this claim did not last long, as it was revealed that Trump’s phone was actually a rebranded HTC U24 Pro, with only a gold case and minor internal component changes. You see? Even a phone that is supposed to represent American values is manufactured in China. With a gross domestic product (GDP) exceeding $32 trillion, the United States is currently the world’s largest economy, while China ranks second with around $20 trillion. On the other hand, the United States is by a wide margin the global leader in various technological fields, and American companies spend hundreds of billions of dollars annually on research and development. From Apple and Google to Microsoft, Lockheed Martin, Boeing, and others, American tech and industrial giants lead their foreign competitors in many sectors. The United States also has no shortage of smartphone brands. Apple, Google, and Motorola are among the major brands in the smartphone market, collectively holding a significant share. However, the vast majority of their products are manufactured outside the United States. So why is it that the world’s largest economy, home to the most advanced technology companies and industrial powers, cannot produce a smartphone on its own soil? Let’s explore this question together. Even threats to impose tariffs won’t work After Trump entered the White House as the 47th President of the United States, his administration adopted strict tariff policies. One of these policies was the imposition of a 25% tariff on smartphones manufactured outside the United States. Trump said he “had a little problem” with Apple CEO Tim Cook over producing smartphones outside the U.S. So he thought that threatening a 25% tax on imported phones might force Apple to bring manufacturing back to the United States. “I have long ago informed Tim Cook of Apple that I expect their iPhones that will be sold in the United States of America will be manufactured and built in the United States, not India, or anyplace else,” Trump wrote on Truth Social. Image via The White House Although Apple currently manufactures some of the iPhone’s chips in the United States with TSMC's help, it still shows no willingness to shift full iPhone production to the country. At the time, renowned Apple supply chain analyst Ming-Chi Kuo wrote on X, “In terms of profitability, it’s way better for Apple to take the hit of a 25% tariff on iPhones sold in the US market than to move iPhone assembly lines back to the US.” However, manufacturing a smartphone in the United States is not as easy as it might seem, and many technical and economic barriers are involved. The lack of necessary manufacturing hubs There is a clear reason why many companies prefer to manufacture their products in China. China has established itself as the main global manufacturing hub for international companies, and over the past few decades, large contract manufacturers have emerged there, allowing companies like Apple to outsource production. One such example is Foxconn, which also manufactures some Apple products in India. Building the infrastructure required to produce smartphones in the United States would require tens of billions of dollars in new investment. Factories would need to be built, essential manufacturing equipment would have to be installed, and, most importantly, a skilled workforce capable of operating these systems would need to be recruited and trained. The United States currently lacks the core infrastructure needed to manufacture smartphones, and for this reason, many companies prefer to outsource production to Chinese contractors rather than spend tens of billions of dollars to build that infrastructure, which is significantly more economically efficient. Additionally, building such infrastructure in the United States could take up to a decade, ultimately leading to a significant increase in the product's final price for consumers. Shortage of trained labor in the U.S. compared to China Decades of serving as a global manufacturing hub have allowed China to build a massive talent pool in the production sector that is almost unmatched worldwide. Today, if a company chooses to manufacture its products in China, it can be confident that the workers involved in production have years of experience in their respective roles and are capable of producing high-quality goods with minimal errors. Even if we assume that tens of billions of dollars were invested in building smartphone manufacturing infrastructure in the United States, finding skilled workers would remain highly challenging. Apple CEO Tim Cook visiting the iPhone 6 assembly line in China in 2014. Image: Tim Cook on X In a 2015 interview on CBS’s 60 Minutes, Tim Cook said the main reason Apple isn’t producing in the US is a lack of skills. "China put an enormous focus on manufacturing, in what you and I would call vocational kind of skills. The US over time began to stop having as many vocational kinds of skills. I mean you could take every tool and die maker in the United States and probably put them in the room that we're currently sitting in. In China you would have to have multiple football fields,” Cook said. Also, in 2017, at the Fortune Global Forum in Guangzhou, Cook once again emphasized the importance of highly skilled Chinese workers. “China has moved into very advanced manufacturing, so you find in China the intersection of craftsman kind of skill, and sophisticated robotics and the computer science world. That intersection, which is very rare to find anywhere, that kind of skill, is very important to our business because of the precision and quality level that we like. The thing that most people focus on if they’re a foreigner coming to China is the size of the market, and obviously, it’s the biggest market in the world in so many areas. But for us, the number one attraction is the quality of the people,” Apple CEO said. Higher labor costs in the United States Producing almost any product in the United States is more expensive than in many other countries, and one of the main reasons is the higher cost of labor in the U.S. According to the Bureau of Labor Statistics, median weekly earnings of full-time workers in the United States were $1,235 in the first quarter of 2026. Meanwhile, the average annual salary in China's private sector in 2025 was RMB 71,590 (US$9,961). In many parts of the world, the weekly wage of an American worker is equivalent to several months of income. Another important factor to consider is that in the United States, the workforce capable of working on a smartphone assembly line is highly specialized and therefore commands higher-than-average wages. According to an estimate by Bank of America, producing an iPhone in the U.S. is technically possible, but “iPhone cost can increase 25% purely on higher labor cost in the U.S.” However, this 25% increase applies only if final assembly is performed in the United States while components are still sourced from China or elsewhere. In this case, the price of a base iPhone would rise from $799 to around $1,000. But in another scenario, if Apple were to produce the required components for the iPhone within the United States, production costs could increase by more than 90%. Trump’s dream for a “Made in the USA” iPhone might never come true In a free-market capitalist economy, one of the primary responsibilities of any CEO is to maximize profit. Using Apple as an example, Tim Cook’s role is to maximize the company’s profits so that it can fund research and development for new products and invest in areas such as artificial intelligence, while also keeping shareholders satisfied. Therefore, it is entirely understandable that Apple would choose not to bring its manufacturing back to the United States and instead keep production in countries where labor is cheaper, and products can be manufactured at a lower cost, thereby maximizing its profit margins. What is your opinion about manufacturing smartphones in the United States? If you are an American citizen, would you be willing to pay hundreds of dollars more for a smartphone made domestically in the USA? Let us know in the comments.
    • Cheers everyone for the replies. It's been very useful. 👍
    • Compared to the 7735HS it is around 25-30% slower in multi-threaded tasks (according to Google search) I did a review of the 7735HS Beelink SER6 Max in 2023, but thinking about it, it's not comparable to the 7730U. For the example you gave about how it will be used, the 7730U is actually an excellent choice for its power and battery efficiency.
  • Recent Achievements

    • Conversation Starter
      jessse3334 earned a badge
      Conversation Starter
    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      194
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      71
    5. 5
      FloatingFatMan
      66
  • Tell a friend

    Love Neowin? Tell a friend!