Editing MycoTaxa:Village pump (technical)/Archive 1 (section)

== Secure login ==

On the [http://en.wikipedia.org/w/index.php?title=Special:Userlogin login page] toward the bottom, it discusses security and offers an SSL option for login [https://secure.wikimedia.org/ secure.wikimedia.org].  However, this url does not work and states "Wiki does not exist".  It has been like this for a while.  I tried it about a month ago and got the same error on a different computer (thought it was a temporary glich as I had used it in the past).  Also, if this gets fixed, could you please link the url on the login page as it would make it much easier when browsing from my phone. [[User:Morphh|<span style="color:green">Morphh</span>]]  <sup>[[user talk:Morphh|<span style="color:chocolate">(talk)</span>]]</sup> <small><i>18:58, 22 October 2007 (UTC)</i></small>
:It's not a link; is says the ''domain'' should be secure.wikimedia.org. But a link would be nice. <span style="font-family: verdana;"> — [[User:Edokter|<span style="color: #008;">'''''E''dokter'''</span>]] • [[User_talk:Edokter|<span style="color: #080;">Talk</span>]] • </span> 19:13, 22 October 2007 (UTC)
::The link is https://secure.wikimedia.org/wikipedia/en/w/index.php?title=Special:Userlogin (which I've had templated at {{tlu|User:ais523/SecureURL}} for a while because the question comes up often enough that it's useful to have a stock response). Last time it was linked from the UI, though, it was changed back (see [[MediaWiki talk:Loginsuccess]]); that connection isn't very fast and has problems (clicking on any link that's hard-coded to en.wikipedia.org, rather than {{tnull|fullurl}}'d, will leave the secure connection and log you out, and there have been problems with the destination of the [[Wikipedia:Upload|Upload file]] link). --[[User:ais523|ais523]] 07:57, 23 October 2007 ([[User:ais523|U]][[User talk:ais523|T]][[Special:Contributions/Ais523|C]])
:::Well it is very confusing and turning it into a link would be helpful.  How is any normal user suppose to know that they're to paste that domain name into the current domain path to the userlogin page?  Most are going to copy the url provided "secure.wikimedia.org" and paste it into the address bar and come up with "Wiki does not exist".  Please link it to something as this is just plain confusing for the normal user.  I'm a computer geek and I didn't catch it - I just moved on disappointed.  If we're going to put it there, we should to make it easy to access.  To the point of leaving the secure connection, I would actually prefer it.  I only need it encrypted when sending my password throught the Starbucks wireless network or something of the sort.  Encrypt my authentication and send me back to en.wikipedia.org - that would be fine with me.   [[User:Morphh|<span style="color:green">Morphh</span>]]  <sup>[[user talk:Morphh|<span style="color:chocolate">(talk)</span>]]</sup> <small><i>15:01, 23 October 2007 (UTC)</i></small>
::::That's easier said than done. Currently, the secure sessions are not exchangeable with the http sessions--meaning that if you log in on the secure server, you will be logged in only on the secure server. There is furthermore very, very little server resource dedicated to secure.wikimedia.org, meaning that if every user who logs in to Wikipedia in a day did so on the secure server, it would crash. This is of course the primary reason that the direct link to the secure server was removed from the login text, and the reason that the URL is intentionally quite difficult to find. Everyone would prefer to use https; unfortunately, it is not feasible at this time. On that note, I think it would likely be a good idea to remove all mention of the secure server from loginend, as it's clearly confusing to many. Those who know enough to find the secure server likely know enough to not get phished. [[User:AmiDaniel|AmiDaniel]] ([[User talk:AmiDaniel|talk]]) 19:14, 23 October 2007 (UTC)
:::::Why have a separate server?  Why not add the cert to en.wikipedia.org and offer the same access across 443 for authentication?  Wouldn't this allow them to maintain session as you transition back to 80?  On a similar note, how come we don't support [[OpenID]]?  [[User:Morphh|<span style="color:green">Morphh</span>]]  <sup>[[user talk:Morphh|<span style="color:chocolate">(talk)</span>]]</sup> <small><i>19:38, 23 October 2007 (UTC)</i></small>
:::::: OpenID is dependent on the implementation of [[:m:SUL|Single-user login]], a.k.a. [[:bugzilla:57|Bug 57]], which will be done sometime between now and the [[heat death of the Universe]]. Secure login in the regular en.wikipedia.org server, is rather hard on the [[virtual host]] setup that Wikimedia uses, and is rather computationally expensive, as described on [[:bugzilla:225|Bug 225]]. [[User:Titoxd|Tito<span style="color:#008000;">xd</span>]]<sup>([[User talk:Titoxd|?!?]] - [[WP:FAC|cool stuff]])</sup> 20:25, 23 October 2007 (UTC)
:::::::I think the last poster on Bug 225 got it right.  You don't have to encrypt the entire thing and you don't have to offer it by default.  I'm not sure how virtual servers are much different than physical servers.  The host names should not matter much as the cert would use the alias name (en.wikipedia.org).  I mean come on... we're a top 10 destination on the Internet and we can't even encrypt the authentication?  If we can't afford the CPU cycles on the server get a SSL gateway or something.  This should really be addressed. [[User:Morphh|<span style="color:green">Morphh</span>]]  <sup>[[user talk:Morphh|<span style="color:chocolate">(talk)</span>]]</sup> <small><i>21:10, 23 October 2007 (UTC)</i></small>