Jump to content
Posted 26 February 2013 - 10:07
Don't worry about it
I think Neobond merely misinterpreted the first post, as not having SSL is something we've discussed in the past (as shown by the link in my previous post)
Ook? Ook. Ook! Ook! (sorry, can't resist.. )
Posted 26 February 2013 - 10:10
Ones that are fully trusted, and don't create browser alerts yeah.. expensive.
Posted 26 February 2013 - 10:13
Posted 26 February 2013 - 10:27
My poke wasn't directed at Neowin (staff), it was towards the fact that for the most part the folks that use Neowin are technologically savvy individuals and someone was just coming across this now (Or so it was believed before Dave posted the old thread). When you quoted the length of time, it literally made me laugh. I just found it ironic.
I'm chalking it up to early money brain cloud (for those of you just waking up) and late night brain cloud (for those like me who are just about to come off a 12 hour overnight shift)
Posted 26 February 2013 - 11:16
Posted 26 February 2013 - 11:17
There was a previous discussion about this here: http://www.neowin.ne...ds-https-login/
Posted 26 February 2013 - 11:43
So reading a thread and came across this statement
"Even the neowin login page is not encrypted"
Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.
So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source<form action="http://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>
Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..
And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!
Now my password is complex random - but I assure you it was in the clear.
Not sure what that auth part is there I highlighted, but hid it as well.
So am I correct in that everyone that is logging into neowin is sending username and password in clear??
Posted 26 February 2013 - 11:54
Posted 26 February 2013 - 11:58
So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.
you'd think the fact that the passwords are stored in clear text would be the real worry here.
How many people's clear text passwords could someone steal by hacking the neowin database. but at least neowin is secure and always running the latest up to date IPB version so there should be no worries of that...
Posted 26 February 2013 - 12:00
We already have a donations page. Except we don't call those people donors, we call them subscribers.
On topic, how about setting up a donation page? Then annoy the hell out of your users, a'la Wikipedia?
Posted 26 February 2013 - 12:00
Posted 26 February 2013 - 12:04
This needs to be sorted , every other day sites and people get hacked this is not helping , if neowin gets hacked how many 1000s of people details will be lost.
I know this is just you to the server problem.
Posted 26 February 2013 - 12:06
As I already pointed out, nothing about your password is stored on our servers as plain text, What YOU send however could be picked up by network sniffing, just like someone could steal your phone and then call any of your contacts on it (if the phone was unlocked).
Posted 26 February 2013 - 12:07
After i read your post above i edited my post , sorry for not reading the whole thread before i posted.