Add HTTPS support to Bulbagarden

[Ben10do]

I know this isn't exactly an exciting idea, but it's important nonetheless.

As far as I can work out, none of the Bulbagarden sites feature HTTPS encryption. Whilst this may seem trivial at a glance, this is something that many people have come to expect from all kinds of websites these days. Given that websites like DuckDuckGo and Wikipedia use HTTPS all the time, for arguably unimportant content, I think that Bulbagarden should follow suit. After all, as things stand, not even our logins are encrypted over the Internet. This could lead to accounts being easily hacked after logging in on insecure Wi-Fi networks (like the classic coffee shop scenario), and this could easily escalate if someone were to use the same username and password on other websites.

It seems like there are certificate authorities out there who can provide certificates for free, so cost shouldn't be an issue. One I found was Let's Encrypt, which should be available relatively soon (they say Mid-2015), but this is, of course, just one option of many.

It would be great if HTTPS could be enabled all the time, everyone, so long as this doesn't cause any issues, but as a minimum, this should be introduced when logging onto the forum and the wikis, and when creating an account, etc. Hopefully this shouldn't be too challenging to implement

 

[Snowy]

I hate sites that use HTTPS all the time as it adds overhead to my internet connection and makes it far harder for me to get a page to load. (I have a pretty rubbish internet connection) That and there just is no need.

That said however, i agree with you on the point of the login system. Logging in to the forum and the wiki should be done via an encrypted connection.

 

[Ben10do]

Fair enough. Always-on-HTTPS could be an option (say, for logged in users of the wikis and the forum).

 

[Kadabra]

This could lead to accounts being easily hacked after logging in on insecure Wi-Fi networks (like the classic coffee shop scenario)

It doesn't quite work that way.

Nevertheless, HTTPS is important for other security considerations and having it always on is slowly becoming standard, being pushed by companies like Google. And yes, Let's Encrypt should be a great option when it launches.

 

[Fig]

@Archaic; knows a lot about internet security and privacy so I'll flag this thread for him so he can give you the summary of what we are/are not considering in that vein.

 

[Archaic]

It's something we've been looking into for a while now. Nothing more I can say on the topic at present.