[Security warning] Hey guys, while logged into bundlestars today I noticed that the website is not using SSL anywhere, which is probably just a glitch introduced with the new (and very nice looking) site redesign. The downside of this is that any personal information/details including all of your game keys in your account will be sent over the Internet unencrypted if you log in and view them. This is probably unintentional, but it leaves an opportunity for 3rd parties to intercept and steal game keys. It's more of a threat to people who use wireless networking, especially in public places, or who might be using proxies or a service like Tor to access the Internet, but it is a security risk to everyone just the same. I've notified bundlestars of the problem and no doubt they'll fix it soon enough. I just wanted to give everyone here a heads up so that people can take steps to help protect their game keys there in the mean time.

The bundlestars website is available over https, and if you manually specify https://www.bundlestars.com you will get the site over SSL however their web links unfortunately link to http version of their own web pages so you'll remain logged in but your traffic will be insecure still. You can work around this problem for yourself if desired in a number of ways at least until bundlestars has updated their website to fix the problem.

Solutions for Firefox users:

1) Install the ForceTLS extension for Firefox - https://addons.mozilla.org/en-US/firefox/addon/force-tls and restart the browser if necessary, then go into the Tools -> ForceTLS Configuration on the firefox menu and type "bundlestars.com" into the "Website" field, check the box marked "Force Subdomains Too", and hit "Add Site". This will force Firefox to always load the bundlestars website over SSL from then on whether you click on a bookmark, a URL on a website, or type the site into the location bar manually - it will automatically override http to https for you on that site and all subdomains from then on.

2) Advanced users who have the HTTPS-Everywhere extension from the Electronic Frontier Foundation installed, can force HTTPS on bundlestars using that instead if desired. I'll leave it up to that extension's documentation on how to do that.

3) Advanced users who have the NoScript extension installed can go into options for HTTPS and add *.bundlestars.com there, and also go into the cookies tab and add it there too to force cookies over HTTPS.

There are likely other extensions/methods that can force HTTPS on websites using Firefox, but these 3 are probably the most popular and well known, and the first one is very minimalistic and just a front end to Firefox's built in functionality and easy to use even for a non-technical user.

Other browsers:
If you're using a different web browser, consult it's documentation to see if it has a feature for forcing HTTPS on websites and how to configure it, and go to that browser's addon marketplace/website and search for "force HTTPS" or "force SSL" to search for plugins for your other browser(s) as they almost certain exist for all browsers.

Hope this helps. I just thought I'd make this little public service announcement to help people protect their (possibly large) collections of game codes from being sniffed off the Internet due to lack of encryption being used there currently. I imagine that bundlestars will be on top of this soon and fix the site to always use SSL once you're logged in at least since they already have it set up to work minus a few glitches.

Yes, I'm a computer security nerd. :)

Practice safe hex! Enjoy! :)