Security question

[Anonymous]

Jeff -- are the DCUM servers vulnerable to the Heartbleed problem?

[Anonymous]

would it really matter? pretty much everything posted is public anyway (and I have to think anyone using it has better targets than trying to trace your posts back to you)

[jsteele]

We don't use SSL, so no. If you login, your password is passed in clear text. So, easily sniffed. No need to hack SSL. Hopefully nobody uses important passwords here.

I've thought about using SSL for logins to protect passwords, but so few people login and it's kind of a headache.

[Anonymous]

So could someone get in through the back door and find out the ISP of posts?

[jsteele]

Anonymous wrote:So could someone get in through the back door and find out the ISP of posts?

There are probably multiple ways that someone could get administrative access to the forums which would expose the IP addresses of posts. I've tried to protect against those ways, but DCUM is not Citibank.