Live data from Hacker News

Show HN: OneSite – Free, unlimited web hosting with cPanel and support. Yep

onesite.co

21–27 of 27 posts

Re: Show HN: OneSite – Free, unlimited web hosting with cPanel and support. Yep

#21
post #19

The cPanel login should be HTTPS.

Hello, At OneSite, we use strict security measures to ensure that your information is always safe, and of course, we will never sell your information to third parties. Our servers are secure and the information you provide us through the whole https://onesite.co/ (including cPanel) is encrypted.

Our cPanel uses self-signed certificates. Self-signed certificates work exactly like a certificate purchased through an SSL Certificate Authority, except that they are NOT signed by a Certificate Authority. Instead they are signed by your server; hence the term “self-signed”.

At OneSite, your data is always safe

Re: Show HN: OneSite – Free, unlimited web hosting with cPanel and support. Yep

#24
post #21
post #19

The cPanel login should be HTTPS.

Hello, At OneSite, we use strict security measures to ensure that your information is always safe, and of course, we will never sell your information to third parties. Our servers are secure and the information you provide us through the whole https://onesite.co/ (including cPanel) is encrypted. Our cPanel uses self-signed certificates. Self-signed certificates work exactly like a certificate purchased through an SSL…

Self-signed certificates are not secure as they are vulnerable to man-in-the-middle attacks.

https://security.stackexchange.com/questions/8110/what-are-t...

With free/cheap certificates widely available through e.g. Let's Encrypt and AWS Certificate Manager, there's absolutely no reason to use self-signed certificates.

The cPanel login page linked to in the footer isn't using any HTTPS, self-signed or otherwise. This means that anyone controlling the network can inject javascript to steal your users' passwords.

Re: Show HN: OneSite – Free, unlimited web hosting with cPanel and support. Yep

#25
post #23
post #20

Earlier quoted context omitted.

Definitely.

Do you have any examples so that we can base it on these?

GitHub - https://bounty.github.com/

Google - https://www.google.com/about/appsecurity/reward-program/

Facebook - https://www.facebook.com/whitehat

Post reply on HN