Neowin Login Not Secure?

By +BudMan
in Site & Forum Issues

 Share

Recommended Posts

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

    <form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

post-14624-0-50929000-1361862547.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Link to comment
https://www.neowin.net/forum/topic/1138606-neowin-login-not-secure/
Share on other sites
Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

Yep. May be an IPB issue

I don't think so - I looked on their website, and their form shows it being posted via HTTPS

<form action="[url="view-source:https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process"]https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process[/url]" method="[url=""]post[/url]" id='[url=""]login[/url]'>

I am hoping someone just forgot the S there -- but that seems unlikely because you can not access neowin.net via https at all. So maybe they don't have a cert to use?

Experienced

Kelxin

Posted
Posted

Most systems that "care" if their accounts could get hacked or not use an SSL connection for at least the login page. Honestly, what damage can really be done on this forum if someone hacks your account? HOPEFULLY people here are smart enough not to use the password on this site on any of their other more important web logins.

Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

I hear yah - it is just a forum.. But personal info about the account could be gleaned form the users control panel. And yeah again great info the password you use here should not be the same as your other logins, etc. But it is still very bad practice, I can not believe it was done on purpose - it must be some oversite somewhere??

Experienced

Kelxin

Posted
Posted

I completely agree, hell, every login page that I've coded the password gets hashed and salted before ever even being submitted to the server, and that ALL gets sent across a SSL encrypted connection. Maybe the server admin doesn't want to pay for a cert? lol

Guest

Posted
Posted

I would imagine the option to use https on the login page is an option in the admin area of IPB. I can't can't find a manual though for IPB.

I can see what your saying but I use lots of sites and I would imagine well over half are not secure. Still, if IPB has a flick switch to enable it maybe it should be enabled. Certs are cheap enough these days. Free is cheap right? :)

I use a different random password for every site I use, still there is information about me (email) that a normal user can't see without my password.

Will be interesting to see what the dev's say.

Experienced

Kelxin

Posted
Posted

Did some research, by default IPB wants to use an SSL connection, and all of the passwords are hashed in MD5 in the database, but are sent in plain text in the hopes that the sysadmin used an SSL connection for the login page.

Experienced

Kelxin

Posted
Posted

Hrm, I think I have about 20ish passwords for my own uses, then a unique password for each of my 200+ clients servers ... Somedays I feel like bashing my head against a wall trying to remember one... but hey, its definitely more secure than some of the other options in the world.

Mentor

nekkidtruth

Posted
Posted

I suppose I'm more surprised it's taken 13 years to discover this (massive?) flaw, but I've alerted Redmak and DaveLegg to have a look.

Thanks BudMan.

I LOL'd at 13 years. What does that say about this "technically savvy" community? Haha :shifty:

  • f0rk_b0mb and Charisma
  • Like 2
Grand Master

Steven P. Administrators

Posted
  • Administrators
Posted

Touche. However, doesn't make it any less humorous. ;)

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • How do you future-proof a home or small office network?

      By Circaflex · Posted

      Personally, I’ve found that it’s usually worth investing in the infrastructure you don’t want to replace later, especially cabling. Running Cat6A (or better, depending on your needs) during an upgrade is relatively inexpensive compared to having to re-cable a few years down the road. For switches I try to balance current specs with realistic growth. If my budget allows it Ill choose switches with higher uplink speeds which leaves room for expanding later on, but I don’t necessarily overspend on access ports if the endpoints won’t benefit from them anytime soon. One lesson I’ve learned is that planning for scalability pays off. It’s much easier to add devices, VLANs, or higher-bandwidth workloads when your network infrastructure already supports it than to replace hardware later.  What is your budget like?
    • How do you future-proof a home or small office network?

      By Nick H. · Posted

      I hate the term, "future-proof." We saw it back in the 90's / 2000's, if not before. You cannot future-proof anything, since there is no definition of how far into the future you plan on prepping for. Best idea is to tell us what you currently have and what its use is at the moment, and we can then offer ideas about some areas that might need an upgrade and other areas that can be left alone.
    • Celebrating Windows XP's 25th anniversary this year

      By Nick H. · Posted

      I can agree that it is being used in a small capacity. I worked for a company where their engineers still used XP, and when asked why it was because their sensor software wasn't compatible with newer operating systems and the software was discontinued so they couldn't upgrade the software. Given that the sensors were still in use by companies, they had to continue using XP to support the sensor, otherwise the price to the company would have gone into the millions or billions. Our response was simple: Ok, you can keep the XP machine. But we're removing it from the network. "But then it can't access the Internet or folder shares!" Yup, kinda the point. If someone wants to continue using an unsecure OS they can do, I have no problem with that. But it should be isolated. Simple. I had a fight with a guy in the engineering department for weeks before he finally relented. But we digress.   What do I plan on doing to commemorate the anniversary? Nothing. I have fond memories of the OS, but at the end of the day it's just an OS. If I had some time I might see if I could install it on my Raspberry Pi for a laugh. But my reflex memory with today's OS ideas would probably get me frustrated and I'd uninstall it after 5 mins.
    • Shutter Encoder 20.2

      By Copernic · Posted

      Shutter Encoder 20.2 by Razvan Serea Shutter Encoder is one of the best video converter software and image, audio available today. It has been designed by video editors in order to be as accessible and efficient as possible. It is one of the few free professional tools. Based on FFmpeg, it has the largest codec library available. You can thus convert your files into many different formats. Complete settings for the most advanced Shutter Encoder has a panel containing a large number of settings, in order to define your own choices based on your files and perfect your video or audio output. Well-thought-out settings, with parameters predefined to create files quickly and easily. List of functions Without conversion: Cut without re-encoding, Replace audio, Rewrap, Conform, Merge, Extract, Subtitling, Video inserts Sound conversions: WAV, AIFF, FLAC, MP3, AAC, AC3, OPUS, OGG Editing codecs: DNxHD, DNxHR, Apple ProRes, QT Animation, GoPro CineForm, Uncompressed YUV Output codecs: H.264, H.265, VP9, AV1, OGV Broadcast codecs XDCAM HD422, AVC-Intra 100, XAVC, HAP....and much more. Shutter Encoder 20.2 changelog: Added "Intel Quick Sync" hardware acceleration for Linux Added 'Identify speakers' option for "Audio transcription" function Improved installer package Improved video player performance Improved timecode display with drop-frame videos Improved naming convention for surround audio files Fixed splash screen freeze Fixed bug with file hanging Fixed bugs with presets loading Fixed bugs with video player's buffer Fixed bug with 'Total length of file' option Fixed bugs with 'Record screen/device' option Fixed bug with "XAVC" & "XAVC Long GOP" functions Rollback to XPDF tool for PDF conversion Removed unused binary architecture for Mac Various corrections Various improvements Download: Shutter Encoder 20.2 | 166.0 MB (Open Source) Download: Shutter Encoder Portable | 185.0 MB Links: Shutter Encoder Home Page | FAQ / Tips | macOS | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft Edge gets tons of security features, including AI model that can see your screen

      By turinglives · Posted

      did you give it permission to do so? its probably on the ToS. After that South Park episode I'm paying attention to them lol

  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post

  • Popular Contributors

    1. 1
      +primortal
      534
    2. 2
      +Edouard
      265
    3. 3
      PsYcHoKiLLa
      152
    4. 4
      Steven P.
      99
    5. 5
      macoman
      66
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!