Shannon's Journal Discussion Thread, Vol. 5

[Shannon]

it's the Subliminal Shop logins that we perform in order to purchase or download that still needs the https around. With only http, we're sending plaintext usernames and passwords, which, if sniffed by a middle man (I could describe in more detail, but I'd rather not), might allow that middle man access to download the compromised user's files, redistribute them, and activate the anti-piracy scripting that we've all spent years listening to. That's what I'm concerned about, not billing security.

It is indeed concerning that login details could be stolen and used to download all our purchases. I doubt that would trigger the anti-privacy script but it would be a huge damage to IML (because if someone goes through the trouble of illegally accessing IML accounts, you can be sure all the subs will be on the black market in a matter of hours.) It would be a lot of pain for the affected users as well, who will have to prove that it wasn’t their responsibility.

Yeah, sorry, in my struggle to remain concise, my emphasis may have landed awkwardly. My thoughts were about IML first, for exactly those reasons, and about the potentially compromised user second. The reference to the anti-piracy scripting was an afterthought (last in the list), not a primary concern, and you're probably right. One would hope that the scripting already accounts for various cases of theft, compromise, or loss (phones, laptops, tablets, usb sticks, MP3 players, remote backup storage, etc), many of which are beyond the user's knowledge or control.

Still, I do take personal responsibility for choices resulting in avoidable losses and for the methods that I choose for storing/accessing the files, which is why my preference has been to log in (for either purchase or download) with https (if available). But we don't have much time before OF v3's introductory price ends, so, while I'd hope for https to be a selectable option (as it has been in the past) before that window of opportunity is over, it sounds like it may not be.

It will almost certainly not be.  My efforts to get this corrected have been delayed for reasons outside of my control.