SSL cert expired

Alex · April 17th, 2018, 09:55 AM

Hi folks -

Wanted to post a thread apologizes for the embarrassing oversight today of letting the SSL cert expire. Had received notifications for awhile, but hadn't gotten around to it yet. I'm remote today (at a security conference, ironically), but hope to get around to updating it late tonight.

To be clear, the site is no less secure (or more secure) than it was yesterday. SSL certs have an expiration date on them, but that timing is a bit arbitrary. Expiration does not mean anything bad happened to them, they've been compromised, or any other issue. It's just good security practice to keep them updated every few years in the off-chance that they were compromised at some point during that period.

Most importantly, there isn't any personal data stored here on this site about any of us. Everything that this site has in terms of user data is essentially open to all already; it's all of our posts that we put up to share with others. I moved the site to SSL awhile back as an exercise, but that turned out to be a bit prescient as Google started to encourage all sites to use SSL, even if there wasn't any sensitive or critical data stored on the site.

Happy to answer any questions here, and also take any well-deserved insults, put-downs, and general abuse for not getting to this in time.

adouglas · April 17th, 2018, 10:24 AM

Go on, admit it. You're Zuckerberg in disguise, aren't you?

Alex · April 17th, 2018, 10:51 AM

I can neither confirm or deny.

Triple Jim · April 17th, 2018, 11:05 AM

Thanks Alex... I got the warning this morning, but figured that by now I can probably trust the site.

DannoXYZ · April 17th, 2018, 12:47 PM

Quote:

Originally Posted by Alex

I can neither confirm or deny.

to verify it’s really you, PM me all your account numbers and PIN

adouglas · April 17th, 2018, 01:39 PM

Quote:

Originally Posted by DannoXYZ

to verify it’s really you, PM me all your account numbers and PIN

Here you go. All the number and PINS are in this post.

Snake · April 17th, 2018, 06:58 PM

I took a leap of faith and clicked ok I trust Alex.

Alex · April 18th, 2018, 07:09 AM

Alright - we're good until 4/2020. Hopefully I'll fix it ahead of time at that point.

Z1R rider · April 18th, 2018, 07:29 AM

CaliGrrl · April 18th, 2018, 10:03 AM

Thanks for updating it! I got the warning, I trust the site, but I didn't know how to tell my computer "go there anyway." So I'm glad it's updated and my 'puter will let me come here again.

DannoXYZ · April 18th, 2018, 10:35 AM

Awesome!

maverick9611 · April 18th, 2018, 01:58 PM

Alex · April 25th, 2018, 11:20 AM

So this is how users at MyEtherWallet were hacked yesterday.

News story: https://www.theverge.com/2018/4/24/1...tolen-ethereum

Someone was able to corrupt/co-opt some DNS entries for the site, set up a new site, and the DNS took some users right to the phishing site. Once there, they had the credentials they needed to then go to the real site and start emptying wallets. Users who were robbed had to click through that "this site cert ain't right" error, did so, and were taken to the malicious site - the site that they landed on couldn't provide a valid SSL cert and the browsers would have warned them.

I only add this for some context about those cert errors. That use case above is pretty much the whole point of the technology. The site that you're going to might not be the one you expect, because the cert can't be validated - be cautious with where you go and what you enter if you do click past those warnings. In 99% of the cases, it's going to be something like happened here on Ninjette, with an expired cert due to an incompetent admin (like me). But every once in awhile, that cert error can be a real tip-off that something bad is about to happen because the site you're going to isn't the one you expect, either because it has been hacked directly, or you're being redirected to an entirely different location than you expected.

CaliGrrl · April 25th, 2018, 01:51 PM

Good to know, thanks. I don't know much about how this works, and I trusted Ninjette, but it's good info.

April 17th, 2018, 09:55 AM	#1
Alex ninjette.org dude Name: 1 guess :-) Location: SF Bay Area Join Date: Jun 2008 Motorcycle(s): '13 Ninja 300 (white, the fastest color!), '13 R1200RT, '14 CRF250L, '12 TT-R125LE, '15 CRF110F, '13 TT-R50E Posts: Too much. Blog Entries: 7	SSL cert expired Hi folks - Wanted to post a thread apologizes for the embarrassing oversight today of letting the SSL cert expire. Had received notifications for awhile, but hadn't gotten around to it yet. I'm remote today (at a security conference, ironically), but hope to get around to updating it late tonight. To be clear, the site is no less secure (or more secure) than it was yesterday. SSL certs have an expiration date on them, but that timing is a bit arbitrary. Expiration does not mean anything bad happened to them, they've been compromised, or any other issue. It's just good security practice to keep them updated every few years in the off-chance that they were compromised at some point during that period. Most importantly, there isn't any personal data stored here on this site about any of us. Everything that this site has in terms of user data is essentially open to all already; it's all of our posts that we put up to share with others. I moved the site to SSL awhile back as an exercise, but that turned out to be a bit prescient as Google started to encourage all sites to use SSL, even if there wasn't any sensitive or critical data stored on the site. Happy to answer any questions here, and also take any well-deserved insults, put-downs, and general abuse for not getting to this in time. __________________________________________________ Montgomery Street Motorcycle Club / cal24.com / crf250l.org / ninjette.org ninjette.org Terms of Service, ninjette.org Member Map Shopping for motorcycle parts or equipment? Come here first. The friendliest Ninja 250R/300/400 forum on the internet! (especially Unregistered)

April 17th, 2018, 10:24 AM	#2
adouglas Cat herder Name: Gort Location: A secret lair which, being secret, has an undisclosed location Join Date: May 2009 Motorcycle(s): 2012 Triumph Street Triple R (street), 2006 Yamaha R6 (track) Posts: A lot. Blog Entries: 6 MOTM - Jul '18, Nov '16, Aug '14, May '13	Go on, admit it. You're Zuckerberg in disguise, aren't you? __________________________________________________ I am NOT an adrenaline junkie, I'm a skill junkie. - csmith12 Nam et ipsa scientia potestas est. Heri historia. Cras mysterium. Hodie donum est. Carpe diem.

April 17th, 2018, 10:51 AM	#3
Alex ninjette.org dude Name: 1 guess :-) Location: SF Bay Area Join Date: Jun 2008 Motorcycle(s): '13 Ninja 300 (white, the fastest color!), '13 R1200RT, '14 CRF250L, '12 TT-R125LE, '15 CRF110F, '13 TT-R50E Posts: Too much. Blog Entries: 7	I can neither confirm or deny. __________________________________________________ Montgomery Street Motorcycle Club / cal24.com / crf250l.org / ninjette.org ninjette.org Terms of Service, ninjette.org Member Map Shopping for motorcycle parts or equipment? Come here first. The friendliest Ninja 250R/300/400 forum on the internet! (especially Unregistered)

April 18th, 2018, 07:09 AM	#8
Alex ninjette.org dude Name: 1 guess :-) Location: SF Bay Area Join Date: Jun 2008 Motorcycle(s): '13 Ninja 300 (white, the fastest color!), '13 R1200RT, '14 CRF250L, '12 TT-R125LE, '15 CRF110F, '13 TT-R50E Posts: Too much. Blog Entries: 7	Alright - we're good until 4/2020. Hopefully I'll fix it ahead of time at that point. __________________________________________________ Montgomery Street Motorcycle Club / cal24.com / crf250l.org / ninjette.org ninjette.org Terms of Service, ninjette.org Member Map Shopping for motorcycle parts or equipment? Come here first. The friendliest Ninja 250R/300/400 forum on the internet! (especially Unregistered)
	2 out of 2 members found this post helpful.

April 18th, 2018, 07:29 AM	#9
Z1R rider ninjette.org certified postwhore Name: Roger Location: Mitchell, South Dakota Join Date: Apr 2014 Motorcycle(s): 1978 Z1R, 1999 EX250(GPz), 2000 EX250, 2002 EX250 Posts: A lot. MOTY - 2018, MOTM - Oct '16	__________________________________________________

April 17th, 2018, 11:05 AM	#4
Triple Jim Guy Who Enjoys Riding Name: Jim Location: North Central North Carolina Join Date: Jul 2016 Motorcycle(s): Ninja 250 Posts: A lot. MOTM - Oct '18, Aug '17, Aug '16	Thanks Alex... I got the warning this morning, but figured that by now I can probably trust the site.

April 17th, 2018, 06:58 PM	#7
Snake ninjette.org certified postwhore Name: Rick Location: Alexandria, Louisiana Join Date: Jan 2009 Motorcycle(s): 05 Blue Ninja 250 Posts: Too much. MOTY - 2017, MOTM - Oct '16, May '14	I took a leap of faith and clicked ok I trust Alex.

April 18th, 2018, 10:03 AM	#10
CaliGrrl ninjette.org certified postwhore Name: Kerry Location: Ventura, CA Join Date: Jan 2016 Motorcycle(s): Ninja250 Posts: A lot. MOTM - Apr '18, Apr '17, Apr '16	Thanks for updating it! I got the warning, I trust the site, but I didn't know how to tell my computer "go there anyway." So I'm glad it's updated and my 'puter will let me come here again.

April 18th, 2018, 10:35 AM	#11
DannoXYZ ninjette.org certified postwhore Name: AKA JacRyann Location: SF East Bay Join Date: Dec 2011 Motorcycle(s): CB125T, Ninja250R racer, Ninja250R street bike, EX250F#1, EX250F#2, VF500F, CBR600RR Posts: A lot. MOTY - 2018, MOTM - Nov '17	Awesome!

April 18th, 2018, 01:58 PM	#12
maverick9611 "a legend in my own mind" Name: maverick9611 Location: Augusta,Georgia Join Date: May 2017 Motorcycle(s): 2008 exploited 250r(red), 2008 klr 650(bull), 2016 duke 390(orange) Posts: A lot. MOTM - Feb '18	__________________________________________________ "trying not to get old"

April 25th, 2018, 11:20 AM	#13
Alex ninjette.org dude Name: 1 guess :-) Location: SF Bay Area Join Date: Jun 2008 Motorcycle(s): '13 Ninja 300 (white, the fastest color!), '13 R1200RT, '14 CRF250L, '12 TT-R125LE, '15 CRF110F, '13 TT-R50E Posts: Too much. Blog Entries: 7	So this is how users at MyEtherWallet were hacked yesterday. News story: https://www.theverge.com/2018/4/24/1...tolen-ethereum Someone was able to corrupt/co-opt some DNS entries for the site, set up a new site, and the DNS took some users right to the phishing site. Once there, they had the credentials they needed to then go to the real site and start emptying wallets. Users who were robbed had to click through that "this site cert ain't right" error, did so, and were taken to the malicious site - the site that they landed on couldn't provide a valid SSL cert and the browsers would have warned them. I only add this for some context about those cert errors. That use case above is pretty much the whole point of the technology. The site that you're going to might not be the one you expect, because the cert can't be validated - be cautious with where you go and what you enter if you do click past those warnings. In 99% of the cases, it's going to be something like happened here on Ninjette, with an expired cert due to an incompetent admin (like me). But every once in awhile, that cert error can be a real tip-off that something bad is about to happen because the site you're going to isn't the one you expect, either because it has been hacked directly, or you're being redirected to an entirely different location than you expected. __________________________________________________ Montgomery Street Motorcycle Club / cal24.com / crf250l.org / ninjette.org ninjette.org Terms of Service, ninjette.org Member Map Shopping for motorcycle parts or equipment? Come here first. The friendliest Ninja 250R/300/400 forum on the internet! (especially Unregistered)

April 25th, 2018, 01:51 PM	#14
CaliGrrl ninjette.org certified postwhore Name: Kerry Location: Ventura, CA Join Date: Jan 2016 Motorcycle(s): Ninja250 Posts: A lot. MOTM - Apr '18, Apr '17, Apr '16	Good to know, thanks. I don't know much about how this works, and I trusted Ninjette, but it's good info.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Trying out SSL	Alex	Forum Information	13	March 7th, 2015 09:05 PM
[superbikeplanet.com] - More From The Thawing Cube Of Expired Red Bull	Ninjette Newsbot	Motorcycling News	0	November 19th, 2014 03:10 PM
Ontario License Expired	MyronGanes	General Motorcycling Discussion	10	March 31st, 2014 09:23 AM
[roadracingworld.com] - Brammo Replaces Expired Federal Tax Incentive With Retail Inc	Ninjette Newsbot	Motorcycling News	0	January 2nd, 2014 11:00 AM