Fix security issues across all publicmobile.ca subdomains

[DTHCND]

There's a number of security issues across many publicmobile.ca subdomains, all of which should be fixed. Specifically...

• http://productioncommunity.publicmobile.ca does not redirect to secure site
• http://communaute.publicmobile.ca does not redirect to secure site
• http://community.publicmobile.ca does not redirect to secure site
• https://communaute.publicmobile.ca provides a certificate that does not list it as a subject alternative name
• https://community.publicmobile.ca provides a certificate that does not list it as a subject alternative name
• Some sensitive cookies (e.g. LiSESSIONID) set by https://productioncommunity.publicmobile.ca are not flagged as secure
• https://activate.publicmobile.ca does not provide intermediate certificates
• https://activer.publicmobile.ca does not provide intermediate certificates
• https://libreservice.publicmobile.ca does not provide intermediate certificates
• https://selfserve.publicmobile.ca does not provide intermediate certificates

Obviously some of these are more serious than others. Some cause passwords to be sent in plain-text over the Internet while others lead to sometimes broken certificate chains.

[pakmode]

Good post. 

[JackL]

Would be great if the website is better. (Less bugs, less respond time etc.).

[armindilo]

I was just asked by a Mod to verify my account via my PIN in a plaintext message through an unsecure page on the site....

---

[CS_Agent]

Hey @armindilo,

Thank you for sharing your concern!

Our moderators always ask to verify the accounts, this is the only way to validate the identity and make sure that your personal information and your account stays safe. If you cannot provide this information, alternate validation options are available.

Regards,

Mary

[armindilo]

@CS_Agent

As I said in my private messages, the issue I have is not with sending my information, the issue I have is that your team expects me to use an insecure connection to send the information.

---

---

[CS_Agent]

Feel free to send a message through our Contact Us form online, here is the link! : https://publicmobile.ca/en/on/get-help/contact-us

@armindilo

[jpar]

Yes, there's no reason to still be on http now. Security is very important.

[Jeremy_M]

We are currently on this idea and will get back when it's completed.

Jeremy

[texwood]

This is related to:

https://productioncommunity.publicmobile.ca/t5/Public-Lab/Investigate-Forum-Login-Not-Secured/idi-p/...

Admins:  please link that idea with this one.