Why no security?

There seems to be BAD security for the forum/game login. Why is this?
BigPoint, Y U NO TLS properly?

We've been using HTTPS/TLS for games for the past several years. Considering recent major vulnerabilities and wide-scale spying/exploitation of games by government entities, it might be useful to provide even a minimal amount of security to your players. AES-128bit security is the baseline standard for forums and games.

I find it amusing/surprising that the 'recover password' pages are secured, but the ones to register an account, login to account, and login to the forum are NOT properly secured.

So you have new forums, time to secure them properly!
My request is to ask your website/forum coders to have a separate 'secure login' link that will let me login on the actual bpsecure.com domain rather than doing it from the front page.

EDIT: After analyzing the login a bit more closely, it seems to route the login through bpsecure.com (which is secured). Unfortunately neither the website nor the forum support secure HTTP renegotiation so it is trivial for someone on public wifi to hijack the account.

So players, change your passwords often and don't play this game on any unsecured (open) wifi networks. This won't protect you (at all) if hackers decide they want to mess things up here, but at least it will mitigate your risks a tiny bit.

FYI, preventing Qualsys SSL to gather basic server security info only makes you more vulnerable to exploitation, not less. You might consider unblocking them if you care at all about security.

**Workaround for Insecure Password Creation/Logins**

EDIT

So if you change your password often enough, you should hopefully be able to avoid the worst of compromises. Now here's hoping that the passwords that BigPoint stores are actually hashed & salted properly instead of being stored in cleartext.

I know the no-double-post rule. This post was enough of an 'edit' and important enough to distinguish from the earlier post. I don't plan to double-post much (if at all) after this.

So can I get any confirmation from mods/devs on what type of forum/website/game security is used? TLS version? Cipher type/strength?
TALK TECHIE TO ME! =D

 

@totallyfresh , of course you can't.

 

The forum login system was designed with security at mind.