I think it would be good to get this on the FAQ because I would expect this question to arise.....
All the browser links are operating on pure HTTP so userid & password go via the Internet in clear text, as do the other pages. This perhaps isn't a major issue for a lot of info but for personal data such as address/phone/DOB it's not ideal. OK - so this is only a singing group application does it really need such security, well only each chorus can probably answer that question but I can't imagine it's that expensive to get an SSL certificate for the server.
Sorry if I missed something but let me know if I've missed that this is an option.
Glenn
You are correct - it's not https right now because of the expense and complexity of an appropriate certificate. Ultimately I'd like to make the login page enforce https, at least. If this was a banking application, it would have been done already! :)
Tom
Tom - completely understand the complexity side of things but would assume that by now you've got a reasonable number of groups on Groupanizer and I'm sure you'll get more given how useful the service is.......but..........
I know we're not talking about a banking application but there are some key pieces of information that are likely to be transmitted over HTTP such as DOB and partners names, not to mention phone & address details. I'll take it as a given that the actual data is secure enough whilst in the DB on the server but anything going over HTTP is open for interception and could be used for nefarious purposes. (ok call me Mr.Paranoid)
So please, if we're paying for a service, is it too much to ask for you to spend a couple of hundred dollars and get a certificate and provide a basic level of security? Geotrust do one which would cover all domains and this is only $149.
http://www.geotrust.com/ssl/ssl-certificates-premium/
Thanks
Glenn
Definitely something I want to do. If that $150 cert can really cover all my subdomains, I will jump on it. It's hard to tell with a quick read. Does it seem to you that the cert would cover chorusone.groupanizer.com, chorutwo.groupanizer.com, etc.? Or would that require their multi-cert option for $500?
T
My read of this https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO6513&actp=search&viewlocale=en_US&searchid=1296416548090
says you need the True BusinessID Wildcard for $500
Ian Harrop
Western Hospitality Singers www.sing4fun.ca
Alberta Sport Parachuting Association www.aspa.ca
ian.harrop@live.com