Neowin Login Not Secure?

By +BudMan
in Site & Forum Issues

 Share

Recommended Posts

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

    <form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

post-14624-0-50929000-1361862547.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Link to comment
https://www.neowin.net/forum/topic/1138606-neowin-login-not-secure/
Share on other sites
Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

Yep. May be an IPB issue

I don't think so - I looked on their website, and their form shows it being posted via HTTPS

<form action="[url="view-source:https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process"]https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process[/url]" method="[url=""]post[/url]" id='[url=""]login[/url]'>

I am hoping someone just forgot the S there -- but that seems unlikely because you can not access neowin.net via https at all. So maybe they don't have a cert to use?

Experienced

Kelxin

Posted
Posted

Most systems that "care" if their accounts could get hacked or not use an SSL connection for at least the login page. Honestly, what damage can really be done on this forum if someone hacks your account? HOPEFULLY people here are smart enough not to use the password on this site on any of their other more important web logins.

Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

I hear yah - it is just a forum.. But personal info about the account could be gleaned form the users control panel. And yeah again great info the password you use here should not be the same as your other logins, etc. But it is still very bad practice, I can not believe it was done on purpose - it must be some oversite somewhere??

Experienced

Kelxin

Posted
Posted

I completely agree, hell, every login page that I've coded the password gets hashed and salted before ever even being submitted to the server, and that ALL gets sent across a SSL encrypted connection. Maybe the server admin doesn't want to pay for a cert? lol

Guest

Posted
Posted

I would imagine the option to use https on the login page is an option in the admin area of IPB. I can't can't find a manual though for IPB.

I can see what your saying but I use lots of sites and I would imagine well over half are not secure. Still, if IPB has a flick switch to enable it maybe it should be enabled. Certs are cheap enough these days. Free is cheap right? :)

I use a different random password for every site I use, still there is information about me (email) that a normal user can't see without my password.

Will be interesting to see what the dev's say.

Experienced

Kelxin

Posted
Posted

Did some research, by default IPB wants to use an SSL connection, and all of the passwords are hashed in MD5 in the database, but are sent in plain text in the hopes that the sysadmin used an SSL connection for the login page.

Experienced

Kelxin

Posted
Posted

Hrm, I think I have about 20ish passwords for my own uses, then a unique password for each of my 200+ clients servers ... Somedays I feel like bashing my head against a wall trying to remember one... but hey, its definitely more secure than some of the other options in the world.

Mentor

nekkidtruth

Posted
Posted

I suppose I'm more surprised it's taken 13 years to discover this (massive?) flaw, but I've alerted Redmak and DaveLegg to have a look.

Thanks BudMan.

I LOL'd at 13 years. What does that say about this "technically savvy" community? Haha :shifty:

  • f0rk_b0mb and Charisma
  • Like 2
Grand Master

Steven P. Administrators

Posted
  • Administrators
Posted

Touche. However, doesn't make it any less humorous. ;)

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware

      By +Warwagon · Posted

      With the current hardware prices Microsoft should lift the restriction. Then if you have the correct TPM then allow you to use X feature, if you don't have the correct TPM then don't but still actually let you run windows. 11. With a disclaimer during install that X features would be unavailable.
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By C:Amie · Posted

      It's good for recycling of course. But commence inflation of a second hand RAM bubble and price gouging on DDR 4 inventory in 3... 2... 1...
    • Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware

      By hellowalkman · Posted

      Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware by Sayan Sen When Windows 11 was first released, one of the most complained-about issues with the new desktop Microsoft OS was its higher system requirements, which pushed many relatively modern and powerful processors and devices onto the officially unsupported list. Thankfully, they have not been updated again for the base OS, though systems require four times the memory and storage if they want to run AI-powered apps and features. As such, Windows 11 technically runs on 4GB of memory, and there is no imposed restriction on the generation of memory it supports. Speaking of memory, prices are extremely high nowadays for hardware, especially DDR5 and DDR4 kits due to the current silicon shortage, and there are also reports of it affecting DDR2 as well, and it might only be a matter of time before even DDR1 gets affected. Before that could happen, an enthusiast took an ancient DDR1-based system and decided to try out Windows 11 on it to see how well the modern OS would fare on such hardware. The system runs an outdated graphics card interface standard based on AGP, or Advanced Graphics Port, called AGP 3.0 or AGP8x. AGP was essentially succeeded by the modern PCI Express (PCIe) bus standard. The user behind the experiment is retro hardware enthusiast Omores, who built the system around an ASRock ConRoe865PE motherboard based on Intel's i865PE chipset from way back in 2003, around the time when AGP was still in fashion. What made this board special back in the day was its unusual support for newer Core 2 Duo and even Core 2 Quad processors while still retaining older DDR1 memory support and an AGP8X graphics slot, making it an ideal bridge or link between two vastly different generations. Powering the machine was Intel's Core 2 Quad Q6600 alongside 3GB of DDR1 RAM and an ATI Radeon HD 4650 AGP graphics card, one of the final and most capable GPUs released for the aging AGP interface. While installing Windows 11 itself was relatively easy by bypassing Microsoft's hardware checks, getting the graphics card fully functional proved to be some challenge. Microsoft had quietly dropped native AGP support after the earliest releases of Windows 10, meaning newer versions of Windows no longer include the necessary Graphics Address Remapping Table (GART) drivers required for proper AGP acceleration. Without them, AGP graphics cards typically boot up, though with limited functionality, and can often throw a Code 43 error in Device Manager. To work around the limitation, Omores extracted Intel's legacy AGP440 SYS driver from an early Windows 10 release and paired it with a modified INF file so Windows 11 would correctly recognize the chipset. Following this and combined with AMD's final 64-bit Catalyst AGP drivers from 2012, the Radeon HD 4650 was able to operate with full AGP 8X acceleration intact. The result was said to be surprisingly usable for hardware that is over two decades old. Hardware-accelerated H.264 video playback worked correctly and benefited apps like Firefox, while legacy applications and games ran without major graphical issues. The system also successfully completed the 3DMark 2001 benchmark, although performance naturally lagged behind what the same hardware achieves under Windows 7, which is significantly lighter than Windows 11. There was, however, one unavoidable limitation as Microsoft's Windows 11 version 24H2 introduces a mandatory SSE4.2 CPU instruction requirement that cannot be bypassed through installer modifications or registry tweaks. Since no AGP-era processor supports SSE4.2, Windows 11 version 23H2 effectively becomes the final release capable of running on such systems. Regardless, it is still a very cool feat and quite fascinating to see just how stable Windows 11 turned out to be on such unfamiliar hardware. Source: Omores (Patreon) via O_MORES (Reddit)
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By +Good Bot, Bad Bot · Posted

      That will only really help other players that are also responsible for creating the problem.
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By Nick H. · Posted

      Well, it's good to know that they have found a workaround to a problem that they helped create, I guess...

  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post

  • Popular Contributors

    1. 1
      +primortal
      538
    2. 2
      +Edouard
      266
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!