Let's remember to use httpS for images/avatars... :)

[Fred Barclay]

G'day mates! Back after the events of February there was a big push for us to use https for all avatars and images. While this was mostly successful, time has passed and we're getting more and more images or avatars that are posted to http sites, rather than https sites.

Using https on as much of this forum as possible, even for links, images, and avatars, keeps it safer for all of us. I'm no internet expert, so I'll let Clem explain why:

A quick note about HTTPS: It doesn't like mixed content.

If there's anything in the page that requires HTTP content to load, then the page isn't considered trusted (and I think that results in no encryption taking place).

Where it's most important is on the login page, so that's ok.

But if you wonder why sometimes the green lock doesn't appear in the address bar, it's probably because somebody appearing on the page has an avatar pointing to an http address (it could even be somebody in your notification drop down).

So to all the veterans out there who appear everywhere on this forums, please try to point to an https link if possible.

Same thing for the signatures.

And as xenopeek points out:

[Https] protects communication. Mostly on your side, against local or middle attacks.

In other words, non-https images and links won't necessarily make the Mint forum servers insecure, but they can make you personally insecure, even if it's not your image. Some-random-guy's non-https image can be used for tracking and stealing the privacy of the visiting users.

So for the good of everyone here, can we all take a look at our avatars, links in our signatures, and any images we may have posted recently; and convert them to https if possible?
These are some https websites that offer free image hosting:
https://imgur.com/
https://postimage.org/
https://en.gravatar.com/
https://imgsafe.org/
Just make sure you use the https version of these sites, as there are also http versions.

If you have any questions feel free to ask below.

Thanks, and happy Minting!

EDIT: added two new sites thanks to Moem and all41.
EDIT 2: Correction thanks to Cosmos.

[Moem]

This is a good post, and you should feel good.
Here's another suggestion: http://httpsimage.com/

[Cosmo.]

I agree also, but I have not a good expectation, if this thread will help. I can see here with one view, if a user uses content (avatars) via a not secured connection (they get automatically blocked here and I get a notice instead) and I am astonished, how many even veteran users still provide their content via http.

[Fred Barclay]

I agree also, but I have not a good expectation, if this thread will help.

Oh, I have no idea, but "It is better to light a single candle, than to curse the darkness."

One thing we can do is PM users who don't do this and ask them (nicely!) to use an https service. I've done it a couple of times and the chaps I've contacted have always been very understanding.

[kyphi]

Nice one Fred.

Since it is not a good day for a flogging, I changed the source of my avatar to https

Also, thanks for providing alternative URLs - that made the change so much easier.

[Fred Barclay]

Thanks kyphi!
It's never a good day for a flogging in my book.

[Fred Barclay]

This is a good post, and you should feel good.
Here's another suggestion: http://httpsimage.com/

Thanks, Moem.

A quick question about that site: why is it http but hosting https images?
How does that work?

[all41]

I found
https://imgsafe.org/
to be very quick and easy

[BigEasy]

A quick question about that site: why is it http but hosting https images?
How does that work?

Easy! Just replace http with https and connection became secure

[Fred Barclay]

There we go! https://httpsimage.com/ works for me.
Thanks, BigEasy.

all41 and Moem: thanks a lot for the pointers. I'm editing my post to add 'em in.

[Moem]

A quick question about that site: why is it http but hosting https images?

I'm not sure, but I uploaded an image (no account needed) and then looked at it and it was https. So I'm sure that it works.

[Cosmo.]

I agree also, but I have not a good expectation, if this thread will help.

Oh, I have no idea, but "It is better to light a single candle, than to curse the darkness."

As all people I usually want to be right with what I write. This is an exception. If all or at least most switch to https I will be happy, that they have proven my fear to be wrong.

[BigEasy]

There is nothing wrong with http. Is anybody from here walking on the street wearing bulletproof suit and casket? It is very safe! So not? But I`m sure nobody wearing it. Same with http/https. Https is safe, of course, but... mostly it looks like mass hysteria.

[Pentarctagon]

There is nothing wrong with http. Is anybody from here walking on the street wearing bulletproof suit and casket? It is very safe! So not? But I`m sure nobody wearing it. Same with http/https. Https is safe, of course, but... mostly it looks like mass hysteria.

Well, the major browsers disagree apparently. They're all going to be marking normal http as insecure soon.

[Cosmo.]

This thread is not about https vs. http. It is about mixed content, quite a different case.

[Flemur]

Test image

Edit: http. I'll try moving it.

Edit: now https from imgur. Hurrah.

[Moem]

There is nothing wrong with http.

If you say so. But if Clem requests politely that we use https, why not do it? I can't think of any good reason to refuse.

[Amii_Leigh]

*sigh* It only took me two hours to find the last one!

Well, I finally got it to work, lol

[Pjotr]

My avatar wasn't a problem, but this thread triggered me to fix a "mixed content" issue on my own https website. So: thanks for bringing this up again.

[Moem]

*sigh* It only took me two hours to find the last one!

You can still use that same one. As long as you upload it to a service that shows it using HTTPS. (But the current one looks, nice, too.)