Jump to content



Photo

Neowin Login Not Secure?

question suggestion

  • This topic is locked This topic is locked
108 replies to this topic

#1 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 106
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 26 February 2013 - 07:10

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

    <form action="http://www.neowin.net/forum/index.php?app=core&amp;module=global&amp;section=login&amp;do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

passwordinclear.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??


#2 Kelxin

Kelxin

    Neowinian

  • Joined: 08-April 04

Posted 26 February 2013 - 07:18

Yes, the username and password on neowin are in pure clear text when sent to their servers. No SSL, no hashing, no encryption, just your name, your password.

#3 trek

trek

    Neowinian Senior

  • Joined: 11-August 02
  • Location: Vancouver, Canada

Posted 26 February 2013 - 07:20

Yep. May be an IPB issue

#4 +SharpGreen

SharpGreen

    Now with built-in BS detector.

  • Tech Issues Solved: 2
  • Joined: 20-August 04
  • Location: North Carolina
  • OS: Ubuntu 14.04 and Windows 10
  • Phone: Galaxy Nexus

Posted 26 February 2013 - 07:21

This sort of thing really is more common than you'd think.

#5 OP +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 106
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 26 February 2013 - 07:28

Yep. May be an IPB issue

I don't think so - I looked on their website, and their form shows it being posted via HTTPS

<form action="[url="view-source:https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process"]https://www.invisionpower.com/clients/index.php?app=core&amp;module=global&amp;section=login&amp;do=process[/url]" method="[url=""]post[/url]" id='[url=""]login[/url]'>

I am hoping someone just forgot the S there -- but that seems unlikely because you can not access neowin.net via https at all. So maybe they don't have a cert to use?

#6 Kelxin

Kelxin

    Neowinian

  • Joined: 08-April 04

Posted 26 February 2013 - 07:30

Most systems that "care" if their accounts could get hacked or not use an SSL connection for at least the login page. Honestly, what damage can really be done on this forum if someone hacks your account? HOPEFULLY people here are smart enough not to use the password on this site on any of their other more important web logins.

#7 Osiris

Osiris

    Neowinian God!

  • Tech Issues Solved: 1
  • Joined: 31-October 01
  • Location: Australia
  • OS: WIndows 8.2
  • Phone: Nokia 930

Posted 26 February 2013 - 07:30

ah keep it as plain text, that way if I ever get drunk and go turbo on the forums I have a scape goat now.... :p

#8 articuno1au

articuno1au

    Neowinian Senior

  • Tech Issues Solved: 3
  • Joined: 20-March 11
  • Location: Brisbane, Australia

Posted 26 February 2013 - 07:32

Expectation of the lack of password entropy isn't justification for a site not following best security practices..

Not to mention, password entropy is the biggest issue with authentication now days >.>

SO. Not good >.>

#9 OP +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 106
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 26 February 2013 - 07:32

I hear yah - it is just a forum.. But personal info about the account could be gleaned form the users control panel. And yeah again great info the password you use here should not be the same as your other logins, etc. But it is still very bad practice, I can not believe it was done on purpose - it must be some oversite somewhere??

#10 trek

trek

    Neowinian Senior

  • Joined: 11-August 02
  • Location: Vancouver, Canada

Posted 26 February 2013 - 07:33

True, but VB's I frequent also md5 hash the passwords first even if the post action is not encrypted

#11 Kelxin

Kelxin

    Neowinian

  • Joined: 08-April 04

Posted 26 February 2013 - 07:43

I completely agree, hell, every login page that I've coded the password gets hashed and salted before ever even being submitted to the server, and that ALL gets sent across a SSL encrypted connection. Maybe the server admin doesn't want to pay for a cert? lol

#12 ]SK[

]SK[

    Neowinian Senior

  • Tech Issues Solved: 2
  • Joined: 12-October 04
  • Location: Nottingham, UK
  • OS: Windows 8.1
  • Phone: Nexus 5

Posted 26 February 2013 - 08:02

I would imagine the option to use https on the login page is an option in the admin area of IPB. I can't can't find a manual though for IPB.
I can see what your saying but I use lots of sites and I would imagine well over half are not secure. Still, if IPB has a flick switch to enable it maybe it should be enabled. Certs are cheap enough these days. Free is cheap right? :)

I use a different random password for every site I use, still there is information about me (email) that a normal user can't see without my password.

Will be interesting to see what the dev's say.

#13 Kelxin

Kelxin

    Neowinian

  • Joined: 08-April 04

Posted 26 February 2013 - 08:20

Did some research, by default IPB wants to use an SSL connection, and all of the passwords are hashed in MD5 in the database, but are sent in plain text in the hopes that the sysadmin used an SSL connection for the login page.

#14 vetScorpus

Scorpus

    Tim Schiesser

  • Joined: 04-May 11
  • Location: Australia

Posted 26 February 2013 - 08:20

I imagine that now this has been brought to our attention that the developers will roll in higher security into the upcoming site-wide updates, because this kinda isn't okay

#15 tkaw220

tkaw220

    Neowinian

  • Joined: 02-October 12

Posted 26 February 2013 - 08:21

I have several pairs of password: 1 for emails; 1 for website which related to finance or may involve credit card purchase, and another 1 for anything else (I have no doubt on Neowin security :shifty: ).