Getting messages that DU is not secure

[Marthe48]

This is just an fyi. Over the last week, I've gotten random pop-ups from Google that DU isn't providing a secure connection. The pop-up notes that the connection is usually secure and has buttons to choose Go Back or Continue. I close the window and try again in a few minutes with no further problems. This has happened in the morning and afternoon, but I can't remember all the days. It happened about 3 p.m. EST and I thought I'd let you know.

Yesterday, I told a person about DU. They said when they looked, their security set off warnings. I don't know who their provider or security is. They are not likely to check in again. I hope whatever is going on isn't discouraging a lot of people from looking at the site.

Thanks for all you do.

Marthe48

[EarlG]

1. If it happened when you clicked on a thread

it's most likely because someone posted an image that is hosted at an insecure URL.

All DU pages start with https:// which means the page is secure. But on some pages, someone might have linked to an image which is hosted at a URL beginning with http://, or they might have posted embedded social media content that happened to have an insecure image hotlinked within.

The missing "s" means that the URL is not secure. If there is a hotlinked image at an unsecure URL posted on a secure DU page, this is known as "mixed content" -- or more specifically in the case of images, "passive mixed content" -- and depending on your security settings, your browser might throw out a warning.

The bottom line though is that DU pages are all https:// -- if you try visiting http://www.democraticunderground.com you'll see that you are forced to https://www.democraticunderground.com instead -- and our software is designed to disallow the posting of content which could be dangerous -- for example, scripts, stylesheets, and certain types of media. We allow image hotlinking, and we allow social media embeds from a handful of social media apps (which could potentially include a link to an insecure image), but that's it. Things like our Sign In or Account Settings page -- where you may be entering important data such as usernames, passwords, and email addresses -- will never contain mixed content, and so are completely secure.

I'm not sure what happened with your friend, but it sounds like they might have their security settings jacked up pretty high, or perhaps they're running an extension that provides extra protection. I just tried visiting DU in Chrome with no content blockers or other extensions running, and I did not get a warning.

[Marthe48]

2. I open Google, have DU as one of the shortcut buttons

I click on that to open DU. The URL has the wired Ethernet connection symbol. No https://

I usually just leave the DU window open and I'm signed in. Sometimes, my computer is slow, so I close all the windows and reopen. I don't think what I've noticed is because I clicked on a link or a post.

I'm going to assume the friend has high security settings. I'll delete my shortcut button and reenter it,, making sure the beginning is https://

Thank you.