Do I need to use HTTPS if I'm only concerned about passwords sent cleartext?
 

Greetings vb!

So I wanted to move my vb4 forum over to SSL and am completely ready to do so, but one concern is I want to avoid the numerous unsecured content warnings that users will get because there are a variety of different image hosts on the site (most of which are sent via HTTP)

I do know that vbulletin sends the login passwords as salted hashes, but I am curious of the vulnerabilities of that hash. If I'm mainly worried about passwords getting sniffed/cracked, would I really require HTTPS? Are there any other concerns that I am oblivious to?

Thanks a lot in advance!

Also: Anyone have any experience with this mod: https://vborg.vbsupport.ru/showthread.php?t=288450
I need users to be able to keep their passwords for now

vBulletin only sends passwords as hashes, as far as I know, it uses JavaScript to hash the password before sending it (the salt is NOT applied, as each user's salt is different, and in order to apply the salt before sending the password, the client would need to know what salt to use). Honestly, I'm not all that concerned with passwords being sent over the clear as hashes, as a decent password will be extremely difficult to brute-force (and not likely worth the effort anyway). And when you consider that many other forum systems actually do send the password in the clear (I think, it's been awhile since I've dealt with anything else), I would think that hashes are good enough, at least for your average website.

As for the mod you've linked, you would not be able to use that while allowing everyone to keep their current passwords, as the very large disclaimer text reads.