How Safe is Your Site?

Last year I posted about switching to https from http. If you haven't done this, you need to read the post and make the change. It's VERY EASY to do. This is a safety and security issue even if {like me} you aren't a commercial site. Why? Http is an old system and has serious and known flaws that allow hackers to breach your site.

Recently I noticed several of my old linkups mysteriously had a photo of a car added to the quilts. My site is https but the linkup company I used had a flaw that Google warned me about. Simply deleting the linkup wasn't enough. Those linkups with the car photo stubbornly remained. The hackers came through that flaw and added the code into MY post. I had to delete the string of code in HTML. {I'm a not a professional coder so my solution was to delete everything from my signature on down.} If you check, you'll see the explanation I added.

What I did NOT do was click on that car link. That could have compromised my computer. By adding their own link, the hackers could make it point to any site they wanted. I'm sure "sinister people" pay them to link a porn site, a bitcoin or Nigerian scam, or something else through my innocent post. I'd seen an uptick in odd sites to my blog and was trying to track them down.

If you don't have https and/or you link to sites that aren't https, you are helping criminals. Please don't. 


The world moves on.

Lately some of the blogs on my sidebar have been "coming up blank." I click on them but the page doesn't appear. In fact, all that appears is one of these icons.

I use Chrome, a Google product. In May, Google announced they would start flagging insecure sites because most sites worldwide now use https and it's better to call out the laggards. Now it appears they've moved to the next step to help keep us all safe: Chrome won't let me go to sites that aren't https. I asked DH and found out I could override this choice. Hey, I'm an adult. But that would be like taking those stupid ridiculous bird box challenges.

I mean, really.

If the experts {among whom I am NOT included} think it's foolhardy to go to an insecure site, why would I override them? Even if your site is only an innocuous quilting blog, too many nasty people can hack in through it. So...

I checked and I can get there on Safari. But I won't. If you aren't https:, you won't see me until you are.

Please. And thank you. Ann

Putting the Top Together and Switching to HTTPS on Blogger

Another week, another disaster. This time California wildfires. My brother helped with some in Colorado earlier this year. There are opportunities for each of us to help somewhere. This planet is our only home; everyone is a neighbor.

I moved the blocks to the design wall as I sewed the diagonals. Arranging blocks in front of the oven won't work two days in a row. ;-)

Blocks sewn and transferred to the design wall

Switch to HTTPS

As we use technology we need to keep our hardware and software as secure as possible. Fantastic programmers are constantly finding solutions to weaknesses in the system. They report how to plug those holes. With phones, tablets, and computers it's frequently added to the system updates but we still have to push the button. Not to update is like refusing to wear your seatbelt.

We are all aware of the recent Equifax hack that stole millions of records. Current reports suggest hackers got in because Equifax failed to update a security patch for over a month. Through the years bloggers have been hacked; their links suddenly point to porn sites or their entire site sends you to a scam page instead. Fortunately there's an easy fix if you use Blogger. Simply switch to HTTPS, that's Hypertext Transfer Protocol Secure.

The "secure" is the important part because data can't be altered during transfer (your links won't be hacked) and users are sure they are communicating with your website (no man-in-the-middle attacks where a hacker redirects your entire site.

In Blogger, go to Settings then Basic. Click on "Yes" under HTTPS to HTTPS Redirect.

Hooray. You're safer already but you're not done. You'll probably see a "mixed message" note. This is a tedious but important repair. Get some coffee and expect to spend some time. How much time? That depends on how many links need fixing. Google has a page explaining how to repair mixed content for Blogger on Chrome. (This is what I use; I'm not a programmer.)

The first part reads:

Here's where you find JavaScript Console:

Here's what a mixed content message looks like. It's color coded. No, I don't know what all the other stuff means.

You must find that code in on your site and fix it. {Google has more information on discerning whether it's coming from a single page or is on multiple pages. Read the link above for that information.} If it's someone else's gadget, send them an email asking them to repair it. I could repair some; others need someone else to fix. I've given them a deadline.

Once you finish your old posts and pages, it's easier to avoid these errors in future. Here's how.

Yes, that code looks like the foreign language it is. But we can learn to understand the parts we need to repair. It's like learning to use SpellCheck. Good luck and "let's be careful out there."

EDIT: I prefer to create and edit my posts in Chrome. It and Blogger are both Google products so I expect fewer interface issues. You can check JavaScript in Safari. It's in the Develop menu.




If you can't find Develop, turn it on by going to Preferences...




and then clicking the Advanced tab.

JavaScript appears at the bottom of the screen. The correction process should be the same as with Chrome but I'm not certain of the details.

Enjoy the day, Ann

And That's What Happened to the Comments

I'm very grateful to Google for giving me a free Blogger account. In general it's been easy to use. Occasionally I've added some html and some buttons.

I don't have many followers; I'm not trying to make money; I simply wanted a new way to connect with people who share my interests rather than being limited to a guild. Blogging gives me a small platform, flexibility in the length, frequency and amount of my writings with time to think before I publish. There's a way for me to quickly link to sites I like to read as well as a way for people to respond to my posts. I think of it as a modern combination of a diary and letters to friends. Reading comments and recent posts on blogs I follow has become part of my routine.

But I remain grateful to Google for this opportunity. So I've tried to repay them by trying out new features they publish. Just after I started my blog they came out with new templates and I switched to one. Not that I cared that much but it seemed a good way to give them more test subjects. About a year ago they suggested linking Blogger to Google+ and I went along with that. I lost some comments when I linked them. It didn't make me happy but I thought I was doing the right thing to help the company that helped me. But with that link I became a No Reply Blogger when commenting on other sites. Not what I wanted.

So I unlinked the accounts and thought that was done. Wrongo. BEFORE unlinking the accounts, I should have to gone into Google+ setting and unchecked the box to use Google+ comments. (It turns on automatically when you link the two but must be manually turned off.) Only after that is done will returning to the old Blogger profile have a real effect. See the post by PeggyK in Google's product forum here for a better explanation.

The downside is all previous comments on my blog have disappeared. Again. Somehow they were linked to Google+ and not to my blog. How sad. Some of the discussions we had in the comments section were better than the original post. It was like losing letters in a fire - there is no recovery.

I think things are set so you can now comment without being on Google+. I refuse to sign in on other platforms to leave comments and didn't realize I had this relic on my site. I'm so sorry all the old connections were lost but hopefully this will work equitably for us all in the future.

Enjoy the day, Ann