Recommended Posts

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

    <form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

post-14624-0-50929000-1361862547.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Link to comment
https://www.neowin.net/forum/topic/1138606-neowin-login-not-secure/
Share on other sites

Yep. May be an IPB issue

I don't think so - I looked on their website, and their form shows it being posted via HTTPS

<form action="[url="view-source:https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process"]https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process[/url]" method="[url=""]post[/url]" id='[url=""]login[/url]'>

I am hoping someone just forgot the S there -- but that seems unlikely because you can not access neowin.net via https at all. So maybe they don't have a cert to use?

Most systems that "care" if their accounts could get hacked or not use an SSL connection for at least the login page. Honestly, what damage can really be done on this forum if someone hacks your account? HOPEFULLY people here are smart enough not to use the password on this site on any of their other more important web logins.

I hear yah - it is just a forum.. But personal info about the account could be gleaned form the users control panel. And yeah again great info the password you use here should not be the same as your other logins, etc. But it is still very bad practice, I can not believe it was done on purpose - it must be some oversite somewhere??

I completely agree, hell, every login page that I've coded the password gets hashed and salted before ever even being submitted to the server, and that ALL gets sent across a SSL encrypted connection. Maybe the server admin doesn't want to pay for a cert? lol

I would imagine the option to use https on the login page is an option in the admin area of IPB. I can't can't find a manual though for IPB.

I can see what your saying but I use lots of sites and I would imagine well over half are not secure. Still, if IPB has a flick switch to enable it maybe it should be enabled. Certs are cheap enough these days. Free is cheap right? :)

I use a different random password for every site I use, still there is information about me (email) that a normal user can't see without my password.

Will be interesting to see what the dev's say.

Did some research, by default IPB wants to use an SSL connection, and all of the passwords are hashed in MD5 in the database, but are sent in plain text in the hopes that the sysadmin used an SSL connection for the login page.

Hrm, I think I have about 20ish passwords for my own uses, then a unique password for each of my 200+ clients servers ... Somedays I feel like bashing my head against a wall trying to remember one... but hey, its definitely more secure than some of the other options in the world.

I suppose I'm more surprised it's taken 13 years to discover this (massive?) flaw, but I've alerted Redmak and DaveLegg to have a look.

Thanks BudMan.

I LOL'd at 13 years. What does that say about this "technically savvy" community? Haha :shifty:

  • Like 2

Touche. However, doesn't make it any less humorous. ;)

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

This topic is now closed to further replies.
  • Posts

    • Well, it's good to know that they have found a workaround to a problem that they helped create, I guess...
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware by Ivan Jenic Image: Meta The global hardware shortage isn’t exactly news, as the entire world has been struggling with rising component prices for quite some time now. And while big companies certainly aren’t as affected as the average consumer, even they aren’t opposed to the idea of saving a few (million) bucks. Meta appears to have found a way to spend less on new hardware while also putting its outdated infrastructure to use, essentially killing two birds with one stone. The company has built a custom chip that lets it reuse memory from retired servers rather than buying new hardware. The chip is called Vistara and allows for connecting old DDR4 RAM from obsolete servers into new servers that rely on DDR5. The problem Vistara solves goes back to a basic mismatch in how long hardware lasts. Meta replaces its servers every three to five years, but the memory modules inside them are good for seven to ten. When a server gets decommissioned, perfectly usable DDR4 RAM goes with it. Meta is presenting the new method at today’s ISCA symposium, but The Register has got hold of a paper that explains how Vistara works. It's a custom ASIC that bridges DDR4 memory to newer processors via aCXL 2.0/1.1 interface over PCIe Gen5 x16. Meta pulls DDR4 sticks from old machines and installs them in dedicated units it calls MemServers, each of which pairs 768GB of DDR5 with 256GB of recovered DDR4. The operating system sees the DDR4 as an additional memory node and draws from it when the primary DDR5 is running low. Off-the-shelf CXL hardware couldn't do this, so Meta built its own. Existing interfaces bundle their own memory with the controller, which makes reusing old RAM sticks impossible. But Vistara separates the controller from the memory entirely, so Meta can plug in whatever DDR4 sticks it has on hand. Meta plans to deploy the new architecture in hyperscale infrastructure with millions of servers, which should mean that Meta’s AI datacenters will now be more efficient. The company is investing heavily in AI infrastructure, especially with its new AI model, Muse Spark, now widely available. All of this doesn't mean that Meta will exclusively rely on "recycled" RAM, but the company is still looking at considerable savings at scale.
    • Save up to 87% on ChatPlayground AI lifetime subscriptions by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where for only a limited time, you can save up to 87% on ChatPlayground AI: lifetime subscriptions. ChatPlayground AI puts the world’s top AI models in one powerful interface, letting you enter a single prompt and instantly compare outputs from multiple models to choose the perfect response for your needs. Boost productivity and creativity with access to the latest AI giants like GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, and dozens more — all in one window. Whether you’re chatting, coding, generating images, or refining prompts, ChatPlayground AI equips you with advanced tools like prompt engineering, image/PDF chat, saved conversations, and AI image creation, plus priority support to keep your workflow seamless. Access the world’s best AI models Side-by-Side Comparisons: Enter one prompt & instantly view results from multiple AI models to find the best output for your needs 40+ AI Models: Includes GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, Llama, Perplexity, and many more Multi-Function Platform: Access AI for chat, image generation & coding all within a single interface Web Browser Extension: Offers a Chrome extension to seamlessly integrate the platform into your browsing workflow Boost productivity with powerful features ChatPlayground Interface: Designed for seamless AI model comparison in one window Prompt Engineering: Refine & optimize your prompts for better, more accurate responses Chat with Images & PDFs: Upload visuals and documents to get context-aware answers Saved Chat History: Keep track of past conversations for reference & ongoing projects AI Image Generation: Create high-quality visuals powered by top AI image models Priority Customer Support: Get faster assistance whenever you need it What you'll get with the Unlimited Plan Includes unlimited messages/month Built for prompt engineers, startups, and teams who run experiments nonstop Includes priority access to new features and future models Good to know Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: Desktop Max number of device(s): Unlimited Available to both NEW & Existing users Updates included A lifetime subscription to ChatPlayground AI (Unlimited Plan) normally costs $619, but you can pick it up for just $79 for a limited time - that represents a saving of $530 (87% off). Click the link below for more details, always check terms and specifications before making a purchase. Get this ChatPlayground AI (Unlimited) for $79 (was $619) There are also two other discounted plans to choose from. Although priced in U.S. dollars, this deal is available for digital purchase worldwide. Support queries If you have queries or need support for any of the Neowin Deals, please use the contact form here. Neowin Deals are managed and sold by StackCommerce who represent Neowin on an affiliate basis. Why we post these deals We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. So for those that keep moaning and complaining, be thankful we're still online for you to even do that. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
    • I like Tidal, but it still does not control devices from the mobile/app and still no surround support. And yeah re: above comment I still get a lot of network errors and I am on a 4/4 Gbit Fiber connection.
  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      539
    2. 2
      +Edouard
      266
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
  • Tell a friend

    Love Neowin? Tell a friend!