Usenet Providers Websites Security: An Observation(good or bad you decide)
I have noticed it few weeks back around Black Friday but didn't thought much of it afterwards until today when nzbgeek breach came to light so posting it now for those who might be interested.
I am a mod at a forum & during my usual spammer cleaning activities I began to notice an interesting thing around 1-2 years back. Many spammers were posting spam & fraud site links with https. I got curious & started checking their ssl certificates & that's when I came to know about Let's Encrypt which started the trend of giving free ssl certificates which was later followed by cloudflare & some others as well. Nowadays almost all the spammers posted links I remove are https having free ssl certificate from Let's Encrypt & cloudflare(free version). This has got me into the habit of checking ssl certificate of any site I find interesting enough or planning on doing commercial transaction on. During Black Friday deals I did this for all major usenet providers here & these were the results.
Cloudflare: Newsdemon, Newsgroupdirect, Thundernews, Eweka(issued to eweka),Usenetfire, Tweaknews, Usenetexpress, Newsgroupninja
Sectigo RSA Domain: Viper, ~~Blocknews,~~(confirmed using paid ssl) Bulknews
Let's Encrypt: Usenetagency, Usenetprime, Stingyusenet, Usenetfarm, Newshosting, Usenight, Easynews
Alpha SSL: Thecubenet
Go Daddy: Giganews
cPanel Inc: Usenetnow, ~~Frugalusenet~~(confirmed using paid ssl)
None of the ssl certificates used by any of the usenet providers above have EV(Extended Validation)/OV(Organization Validation) which is costlier(~$350-400/year compared to less than $10 for cheap ssl or no cost at all in case of Let's Encrypt). For reference Amazon uses digicert ssl which sells secure site ssl(a tier above their basic ssl) certificate starting from $399/year while globalsign sells OV(organization validated) ssl for $349/year. My own bank uses digicert EV ssl certificate of a higher tier(presumably the costliest one as they can certainly afford it).
I am just surprised/curious about this. I understand indie providers saving money on ssl certificates but at least big providers like newshosting should surely be able to afford a decent ssl certificate costing a few dozen or even a few hundred $ per year because in my opinion if they can't even afford that then it does cast a doubt over their website security aka if you can't even afford to spend on a decent ssl certificate then you also can't afford to spend much on your website's security because let's face it, cyber security nowadays costs a lot of money. This is also why I have decided never to pay directly using my card on any of the above sites & since cryptocurrency are not allowed in my country that leaves only paypal as a payment option for me.
**Edit: I give up. If anyone is interested in understanding the saying "missing the forest for the trees" then see my above post & replies here.**