not secure?

[outlander]

@Lauz @s-jay

one of my other threads have come up not secure again. do you guys know whats going on? thats the second of my threads that have done this but im not finding it on any other thread so far

[outlander]

https://www.saneforums.org/t5/Social-Spaces/CHRISTIAN-CHAT-amp-WORSHIP-PRAISE-PRAYER-SUPPORT-FUN-PEA...

https://www.saneforums.org/t5/Something-s-not-right/Am-i-really-that-selfish/m-p/604593#M145971


these 2 are the ones that arent secure at the moment

[s-jay]

Hello @outlander @Snowie @Mazarita - our tech team has looked into this and here is what they found:

As a result of a Google update to Chrome in July this year, Chrome now says that forum threads are not  secure when members have embedded images in the thread that are from http rather than https websites. It's really a bit of a false positive and suggests something is wrong with the Forums when there's really not.

We will look to update the intructions to encourage members to only insert images from websites that use the HTTPS protocol. Also, increasingly more websites and services are being configured to run over HTTPS so gradually these kind of links should disappear altogether - but that won't help with historical one's unfortunately.

So there isn't really a "fix" for this, but we will be doing a few things to minimise it.

Cheers!

[outlander]

thanks for the update @s-jay
so are the threads that say not secure still safe to use? i recreated a thread instead of the old rough time thread but if i come across it on other threads....

[s-jay]

Yep that's our advice @outlander - it's a "false positive" or, there is actually not anything that not secure about viewing the threads.

[outlander]

ok thank you @s-jay

[Mazarita]

Hi @s-jay, I'm not all that technically aware about the issue, but I wonder why the SANE forums site would be having this problem really.

When we add images to the forum by pasting in a url, is it not the case that the image is actually uploaded from there to our site, rather than use the original, potentially insecure site as an image host?

If the image is being uploaded to our site from the url, I don't understand why there should be any security warning showing up on our browsers when the image appears on forum pages.

That only really makes sense to me if the image is constantly being displayed by referencing the site it was originally hosting it. If that is the way images are being processed at SANE, that could present real problems, as far as I understand these tech issues. Specifically, there would be the problem of the original host site for the image potentially changing the image that appears on that link. I have had this happen on my own sites. Sometimes the original image is even later changed to show advertising instead, but it potentially could be any image completely inappropriate to the forum.

I'm guessing though that the latter is not happening on the forum, as if it was, it seems likely to me that we would have seen some instance of it occurring by now, given the massively wide range of sites members would be accessing for urls.

So, if the image is instead being automatically uploaded to SANE's own domain from the original host site, why should there be any security issue showing up in the browser? As far as I'm understanding it, the image display would be coming directly from SANE's own domain using this upload method.

Forgive me if this is gobbledigook and I'm thinking about these technical issues in a completely mistaken way. But I wonder if you might pass this message on to your tech people just in case there's something in what I am saying that might help resolve this issue better. It's not really a good look for SANE forums to have browser security warnings on pages, and is likely to be of alarm to some people viewing or engaging with the site. If there's any chance of a better resolution, it might be worth pursuing it.

Thanks for reading and considering this, and again, huge apologies if I'm completely barking up the wrong tree.