Hot answers tagged

8

The biggest barrier standing in the way is that Gravatar doesn't support HTTPS, and Gravatars are a big part of StackExchange as a whole. There are a variety of other items that are included from 3rd party sites which would also prevent full SSL "green-bar" support. Until such items are fixed or engineered around (such as building an HTTPS-enabled Gravatar ...


5

All the reasons @Chopper3 gave are still valid ones: The actual authentication process is secured over SSL/TLS. (at least if your OpenID provider isn't made of suck) Everything else you do on ServerFault is public* Adding SSL to StackExchange sites is computationally expensive (Good enterprise SSL accelerators range in cost from about as much as a pony to ...


3

The funny thing is that now a proper SSL certificate is installed, the problem is that it only has names stackexchange.com and *.stackexchange.com. It should be simple to get serverfault.com, stackoverflow.com, etc added as alternative names. Update: but most still redirect to http, except for stackexchange.com itself.


1

So, fast forward to 2014, Stackexchange can now be accessed via https (Yay! And rightly so: Wikipedia is "public" too, still I don't want my employer/wifi sponsor/isp/... to eavesdrop on the connection) - but only with mixed content (Imgur? Quantcast?) and with TLS 1.0 only. Are there any plans to fix this as well?


1

An SSL certificate is important when the StackExchange API is used with JavaScript. Any website that wants to display items relevant to user private data, on a page protected with SSL will show errors about unsecure content. And as Yuhong Bao mentioned, https://www.serverfault.com does have a cerificate, but that certificate is invalid as it only covers *....


Only top voted, non community-wiki answers of a minimum length are eligible