UKC

I get this message quite often recently when clicking a link from a ukc forum.... the rest of the text on the page implies it's UKC's fault.... anyone else get this or is it a firefox thing?

The link in this post does it for me: https://www.ukclimbing.com/forums/t.php?n=668209&v=1#x8606781

"Your connection is not secure

The owner of go.ukclimbing.com has configured their web site improperly. To protect your information from being stolen, Firefox has not connected to this web site.

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate."

In reply to balmybaldwin:

used to get something similar on my phone with ukh but not ukc. It was like that for months and then suddenly stopped. Not a computer buff so no idea why it happened

In reply to Andypeak:

When I log on to the wifi at work, I get this all the time.





...but I still do it.

In reply to balmybaldwin:

Have you tried clearing your cache?

In reply to balmybaldwin:

I get this when connecting to some public wifi hotspots as well.

I simply turn on my VPN and all is well with the world.

In reply to balmybaldwin:

It's not secure for my bank balance, tempting me with $169 keyboards!

In reply to balmybaldwin:

This will happen with quite a lot of hosted wi fi systems, because you are going through a system which is not quite direct to the internet or if you have a very old browser.

It is also going to happen (not for UKC as they have a Comodo certificate) much more in the near future (August 8) if organisations have certain SSL/TLS certificates that have not been updates and the user is using Chrome particularly.

In reply to balmybaldwin:



This looks a bit suspicious to me, I suspect some malware has hijacked your browser and is redirecting things.

In reply to balmybaldwin:

Thanks, I'll check it out. go.ukclimbing.com should be valid. We use it for outbound links.

In reply to EddInaBox:

Paul has just confirmed that UKC do legitimately use that address but I think it's worth explaining why it's not a suspicious address in the first place. The important part of the URL to look at is the *final* bit before the ".com"/".co.uk". That's the domain. Anything extra before the domain, like the "go" in this example, is called a subdomain and is still controlled by the owner of the domain (unless they had been hacked themselves). It's quite common for websites with lots of outbound links to redirect them through a specific subdomain. It's also common for adverts or images to be hosted from their own subdomains.

I can't recall which specific subdomains UKC actually uses but as an example...
"ads.ukclimbing.com" wouldn't be suspicious and would be controlled by the owner of "ukclimbing.com". On the other hand, "ukclimbing.ads.com" would be controlled by whoever owns "ads.com" and would be a suspicious address to see when clicking on a supposed UKC link. (This picture is complicated by the fact that most websites have their adverts, and often images and other media, externally hosted.)

In reply to Paul Phillips - UKC and UKH:

I saw the same thing a few weeks ago on Chrome (which didn't offer any option to force trust in the link/certificate). I haven't seen it since so I assumed it was a misconfiguration on your end that had now been fixed.

In reply to Paul Phillips - UKC and UKH:

I reported this as a fault back in April when you switched servers. Is it necessary to mask your affiliate links under the go.ukclimbing.com CNAME?

Which UKC page did the problem occur on?
https://www.ukclimbing.com/forums/t.php?n=661147&v=1#x8535224

Description of fault:
Your (auto?) affiliate links are perhaps broken like the one for the YHA in this thread, go.ukclimbing.com offers up a certificate that doesn't match (CN go.redirectingat.com). This is a problem because you have HSTS enabled so even though the link is only http browsers won't accept the downgrade.

In reply to beh:

I can't find a message from you I'm afraid. It should be sorted now.