https://support.mozilla.org/t5/Protect-your-privacy/Insecure-password-warning-in-Firefox/ta-p/27861

Firefox is now putting a warning making it more difficult and less attractive to enter login details to sites which are not secure. As a users account could be hijacked with the information sent over that login, time to make it secure?

Yeah, confirming that I've (already) encountered this warning on both lfsmanual.net and lfsworld.net when using Firefox.

I've sometimes wondered that why those sites are still using HTTP instead of HTTPS unlike LFS.net which has used that type of connection/protocol for like two years already? Therefore, I suggest that those two sites would also use HTTPS instead of HTTP.

And it's easy peasy with LetsEncrypt these days...

Might be easier to just use the lfs.net SSL certificate by redirecting traffic from lfsworld.net -> lfs.net/world, just like they did with lfsforum.net -> lfs.net/forum.

Yeah true, would be nicer under the lfs.net domain instead.

FYI, Victor commented on this some time ago (before Let's Encrypt was in public beta).

There are, as most of us (including Vic), know, many reasons as to why a site should be configured properly for HTTPS. The most recent one being that browsers such as Firefox and Chrome have started (will start?) to visually flag sites as insecure not only when the certificate is invalid, but also if it's not configured to use a certificate at all.

For the record, the suggestion to redirect traffic from lfs[x|y|z].net to lfs.net will not work since the web browser would have to do a SSL handshake with the flagged site before being redirected -- still prompting an alert.

Edit: Well, technically the SSL handshake isn't the problem, it's the web browser's validation of the certificate that was transferred in the handshake that prompts the alert.

Thanks for the concern guys.
I'm currently testing let's encrypt on my dev site. Since it's looking good, I'll be looking into implementing it for the remaining unencrypted LFS sites soon.

Thank you One thing I (already) noticed, when you're viewing a page which displays quick information of host, it looks different between in HTTP- and HTTPS-version.

Here's an example:

HTTP-version: http://www.lfsworld.net/hoststatus/?h=Sport%20Racing%20Team%20Finland

HTTPS-version: https://www.lfsworld.net/hoststatus/?h=Sport%20Racing%20Team%20Finland

How about now?

Quote from Victor :

How about now?

Now they look same for me. Thanks

Thank you