Has anyone been getting weird emails through LT lately?

[winnietucker]

And sometimes I get this message when going to a LT post:


Your connection is not private
Attackers might be trying to steal your information from url4216.loupetroop.com (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID


Does that happen to anyone else? Or do you know what it means?

Yikes - should we not be using LT?

 

[pearaffair]

Yikes - should we not be using LT?

I love LT! But I dunno! Should I switch to DB?

I should note that that message has come up when I try to go directly to a specific LT listing; not when I got to the main homepage. And that the copy/pasted info was from my web browser (chrome) to me.

 

[OdetteOdile]

Aside from a few strange inquiries and some spam, all of my actual LT sale transactions have gone perfectly and I’m thankful to have LT as an avenue to sell things. The instances I mentioned above that were strange involved low ball offers of around 25% of my asking price or asking me to ship things before they were paid for. I just politely declined and they never wrote me back. I still prefer LT since I don’t have to pay the 10% final value fee I would have to pay ebay, or the commission % I would have to pay therealreal.

That's good to know! I am still considering it for sure.

 

[yssie]

Yikes - should we not be using LT?

And sometimes I get this message when going to a LT post:


Your connection is not private
Attackers might be trying to steal your information from url4216.loupetroop.com (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID


Does that happen to anyone else? Or do you know what it means?

When you go to LT - take a look at the URL. It starts with https, not http. The extra s on the end stands for “secure”, but it doesn’t mean secure in the way that we do in casual conversation (ie. It’s got absolutely nothing to do with your password, your username, your messages, etc.). What it means is that whoever bought the LT domain bought a website certificate (called an SSL certificate) - and on that certificate, the website they specified it’s for doesn’t match the actual name of the website.

The way to fix it is for the LT owner to ensure that all combinations of the LT URL are listed on the certificate. lt.com, www.lt.com, https://lt.com, https://www.lt.com, http://lt.com, http://www.lt.com (these don’t have the s on the end of http, so they’ll redirect to https://...).

When your browser (Chrome, Safari, whatever) tries to access the LT website, your computer send the website a message saying “I’d like to talk with you now”. The LT site then sends a message back saying “sure, and here’s my SSL certificate”. Your computer will then check the certificate to ensure that the website is what you think it is - if the website says that it’s LT.com, but the certificate installed on the site says that the site is http://xratedyouknowwhat.com, then your computer sees the mismatch and throws that message - hey, @pearaffair, I can see that the cert doesn’t match, but you might know better than me - do you care?” And you can either say “I don’t care” and click through it, or say “oops get me out of here”.

But big practical difference between a mismatch caused by you trying to get to https://www.lt.com and the cert having only https://lt.com and you trying to get to https://www.lt.com and the cert having https://www.xratedyouknowwhat.com

All that to say - it’s a pretty common problem, LT admin should fix it, your passwords most likely haven’t been compromised. I’ll never say never because sh*t happens.

Edit - on my phone and URL remove not working, so changed the “xrated” URLs to just point to google.com

 

[LilAlex]

Oh - like this? I edited it so all the identifying info was removed. I figured it was either someone hoping to try their luck or a reseller. I got quite a few offers I’d consider lowball - but they never bother me (shoot your shot, right?) so I didn’t think about it until you mentioned it...

...which is only part of the reason patients are told to never wear jewelry for procedures! Even for the simplest procedure you are required to leave your jewelry at home. Driving my spouse to one very soon...

 

[winnietucker]

...which is only part of the reason patients are told to never wear jewelry for procedures! Even for the simplest procedure you are required to leave your jewelry at home. Driving my spouse to one very soon...

Ya the story was fishy... I’ve had to go in for surgery before and they made me take my jewelry off.

I honestly just thought she was a reseller trying to use sympathy to get an item low enough to make a nice profit herself. I know resellers use LT to score items.

 

[pearaffair]

...which is only part of the reason patients are told to never wear jewelry for procedures! Even for the simplest procedure you are required to leave your jewelry at home. Driving my spouse to one very soon...

Best wishes to your spouse!

 

[pearaffair]

When you go to LT - take a look at the URL. It starts with https, not http. The extra s on the end stands for “secure”, but it doesn’t mean secure in the way that we do in casual conversation (ie. It’s got absolutely nothing to do with your password, your username, your messages, etc.). What it means is that whoever bought the LT domain bought a website certificate (called an SSL certificate) - and on that certificate, the website they specified it’s for doesn’t match the actual name of the website.

The way to fix it is for the LT owner to ensure that all combinations of the LT URL are listed on the certificate. lt.com, www.lt.com, https://lt.com, https://www.lt.com, http://lt.com, http://www.lt.com (these don’t have the s on the end of http, so they’ll redirect to https://...).

When your browser (Chrome, Safari, whatever) tries to access the LT website, your computer send the website a message saying “I’d like to talk with you now”. The LT site then sends a message back saying “sure, and here’s my SSL certificate”. Your computer will then check the certificate to ensure that the website is what you think it is - if the website says that it’s LT.com, but the certificate installed on the site says that the site is http://xratedyouknowwhat.com, then your computer sees the mismatch and throws that message - hey, @pearaffair, I can see that the cert doesn’t match, but you might know better than me - do you care?” And you can either say “I don’t care” and click through it, or say “oops get me out of here”.

But big practical difference between a mismatch caused by you trying to get to https://www.lt.com and the cert having only https://lt.com and you trying to get to https://www.lt.com and the cert having https://www.xratedyouknowwhat.com

All that to say - it’s a pretty common problem, LT admin should fix it, your passwords most likely haven’t been compromised. I’ll never say never because sh*t happens.

Edit - on my phone and URL remove not working, so changed the “xrated” URLs to just point to google.com

Thank you for this very helpful explanation!