Neowin Login Not Secure?

By +BudMan
in Site & Forum Issues

 Share

Recommended Posts

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

    <form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

post-14624-0-50929000-1361862547.png

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Link to comment
https://www.neowin.net/forum/topic/1138606-neowin-login-not-secure/
Share on other sites
Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

Yep. May be an IPB issue

I don't think so - I looked on their website, and their form shows it being posted via HTTPS

<form action="[url="view-source:https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process"]https://www.invisionpower.com/clients/index.php?app=core&module=global&section=login&do=process[/url]" method="[url=""]post[/url]" id='[url=""]login[/url]'>

I am hoping someone just forgot the S there -- but that seems unlikely because you can not access neowin.net via https at all. So maybe they don't have a cert to use?

Experienced

Kelxin

Posted
Posted

Most systems that "care" if their accounts could get hacked or not use an SSL connection for at least the login page. Honestly, what damage can really be done on this forum if someone hacks your account? HOPEFULLY people here are smart enough not to use the password on this site on any of their other more important web logins.

Grand Master

+BudMan MVC

Posted
  • Author
  • MVC
Posted

I hear yah - it is just a forum.. But personal info about the account could be gleaned form the users control panel. And yeah again great info the password you use here should not be the same as your other logins, etc. But it is still very bad practice, I can not believe it was done on purpose - it must be some oversite somewhere??

Experienced

Kelxin

Posted
Posted

I completely agree, hell, every login page that I've coded the password gets hashed and salted before ever even being submitted to the server, and that ALL gets sent across a SSL encrypted connection. Maybe the server admin doesn't want to pay for a cert? lol

Guest

Posted
Posted

I would imagine the option to use https on the login page is an option in the admin area of IPB. I can't can't find a manual though for IPB.

I can see what your saying but I use lots of sites and I would imagine well over half are not secure. Still, if IPB has a flick switch to enable it maybe it should be enabled. Certs are cheap enough these days. Free is cheap right? :)

I use a different random password for every site I use, still there is information about me (email) that a normal user can't see without my password.

Will be interesting to see what the dev's say.

Experienced

Kelxin

Posted
Posted

Did some research, by default IPB wants to use an SSL connection, and all of the passwords are hashed in MD5 in the database, but are sent in plain text in the hopes that the sysadmin used an SSL connection for the login page.

Experienced

Kelxin

Posted
Posted

Hrm, I think I have about 20ish passwords for my own uses, then a unique password for each of my 200+ clients servers ... Somedays I feel like bashing my head against a wall trying to remember one... but hey, its definitely more secure than some of the other options in the world.

Mentor

nekkidtruth

Posted
Posted

I suppose I'm more surprised it's taken 13 years to discover this (massive?) flaw, but I've alerted Redmak and DaveLegg to have a look.

Thanks BudMan.

I LOL'd at 13 years. What does that say about this "technically savvy" community? Haha :shifty:

  • f0rk_b0mb and Charisma
  • Like 2
Grand Master

Steven P. Administrators

Posted
  • Administrators
Posted

Touche. However, doesn't make it any less humorous. ;)

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • U.S. partially reverses Anthropic AI ban for Mythos but keeps Fable 5 off the market

      By Karthik Mudaliar · Posted

      U.S. partially reverses Anthropic AI ban for Mythos but keeps Fable 5 off the market by Karthik Mudaliar Anthropic says that the U.S. government has finally allowed it to restore Claude Mythos 5. But of course, there's a catch. The rollout is again for a limited set of U.S. organizations that operate and defend critical infrastructure. The company announced this in a post on X (formerly Twitter). This does not mean that Anthropic's latest frontier models are back to normal availability. Fable 5, which was a tuned version of Mythos 5 for public release, remains unavailable. Anthropic said that it is still working with the government to expand Mythos 5 access and make Fable 5 available again, but there's no timeline. Reports from Bloomberg and Reuters say that this decision actually came through a letter from the U.S. Commerce Department. According to Reuters, this would allow more than 100 companies and institutions access to Mythos 5. Reuters also reported that Commerce Secretary Howard Lutnick’s letter removes the need for export licenses for approved companies’ non-US citizen employees, as well as Anthropic’s own non-US citizen employees, while restrictions remain for organizations outside the approved list. Anthropic isn't alone with this kind of controlled rollout. OpenAI's newest model family, GPT 5.6, was announced just yesterday, but isn't available for everyone yet. In its announcement, OpenAI also said that access to these models is initially limited to a select group of trusted partners and organizations, with broader access planned later this year. Both of these cases show that frontier AI launches are no longer just ordinary product releases and more like slow and vetted deployments shaped heavily by the U.S. government.
    • OpenAI announces GPT‑5.6 Sol, its next-generation flagship model beating Claude Mythos 5

      By monterxz · Posted

      Sol, Terra, Luna - aren't those the names of failed crypto coins? 🤣🤣🤣
    • Microsoft Weekly: 5 years of Windows 11, more support for Windows 10, and expensive Xbox

      By TarasBuria · Posted

      Microsoft Weekly: 5 years of Windows 11, more support for Windows 10, and expensive Xbox by Taras Buria This week's news recap is here, with Microsoft giving Windows 10 one more year of support, Windows 11 getting new taskbar settings in preview updates, Steam Machine prices, higher XBOX prices, and many more. Quick links: Windows 10 and 11 Windows Insider Program Updates are available Reviews are in Gaming news Great deals to check Windows 11 and Windows 10 Here, we talk about everything happening around Microsoft's latest operating system in the Stable channel and preview builds: new features, removed features, controversies, bugs, interesting findings, and more. And, of course, you may find a word or two about older versions. On June 24, 2026, Windows 11 turned five. The controversial operating system was released half a decade ago, and during these years, it received a fair share of criticism (such as poor Windows Search and its web results), which Microsoft is now actively addressing with regular preview updates that deliver missing, long-requested features. With Windows 12 nowhere to be seen on the horizon, it will be interesting to see if Windows 11 can stay on the market for as long as Windows 10 did. Speaking of Windows 10 and staying on the market, this week, Microsoft quietly prolonged the Extended Security Updates program for Windows 10, allowing users to get one more year of security updates if they do not want or cannot upgrade to Windows 11. Finally, Microsoft released this month's non-security update for Windows 11. KB5095093 arrived with a traditionally long list of new features, including point-in-time restore, new Windows Update settings, quieter Windows Widgets, new accessibility features, File Explorer updates and performance improvements, and more. Windows Insider Program Here is what Microsoft released for Windows Insiders this week: Builds Canary Channel Build 29617.1000 and build 28120.2374 These builds bring new accessibility features, new Windows Update controls, audio improvements, and more. Dev Channel Build 26300.8758 This build includes redesigned taskbar settings, File Explorer improvements, and more. Beta Channel Build 26220.8754 and build 28020.2366 This small update fixes the OneDrive bug in File Explorer, tweaks system sounds in dark mode, and more. Updates are available This section covers software, firmware, and other notable updates (released and coming soon) delivering new features, security fixes, improvements, patches, and more from Microsoft and third parties. If you use AI-powered browsing history search in Microsoft Edge, the company has bad news. A new update on the Microsoft 365 Roadmap revealed that Microsoft is discontinuing the feature. Despite using on-device models for natural search, some users found it creepy, claiming that Microsoft lacks trust in features like this. While the ability to find pages without using 100% precise words may sound cool, customers argued that it was nothing but another feature to bloat the browser with more AI. Good riddance? PowerToys received several updates this week. For one, Microsoft released version 0.100.1 with several improvements and bug fixes for the recently arrived version 0.100. A couple of days later, Microsoft dropped another update, this time fixing memory leaks in Command Palette Dock. In addition, the company is working on a new module that will make it easier to switch between windows within one application using the Alt + ` shortcut. The new module should make it to the stable release somewhere soon. Here are other updates and releases you may find interesting: New Ventoy update adds Windows 11's mandatory update support and more Microsoft updates Visual Studio Code with chat cost tracking and multi-agent chats Microsoft is building an AI datacenter that "uses less water than a fast food restaurant" Microsoft adds new AI study and teaching tools for free to Microsoft 365 Education Researchers claim Microsoft's quantum breakthrough is flawed by basic Python errors Microsoft is bringing a much-needed Recap app to Teams Microsoft's fast coding model, MAI-Code-1-Flash, comes to Copilot Business and Enterprise Here are the latest drivers and firmware updates released this week: AMD Radeon Software 26.6.2 with FSR 4.1 support for RDNA 3 graphics card. However, the driver contained a bug, which prevented installations on Windows 10 PCs. AMD fixed that with a quick hotfix update. Reviews are in Here is the hardware and software we reviewed this week This week, Steven Parker published several reviews. He shared his experience with the Creative Sound Blaster AE-X PCIe, a high-quality sound card with a headphone amp, low-latency communications, great build quality, and DSD256. However, it is on the pricier side of the spectrum, and it lacks EMI shielding. Check out the full review here. The second review is about the TerraMaster F4-425 Pro, an octa-core Intel NAS with a stand-out feature: built-in AI (OpenClaw). We also published a few Hands On reviews, which you can view below: We check out the SKG PS700 Neck Massager SKG Hand Massager with Heat OS500 hands on Hands-on with BOOX Tappy: cute little reading accessory Hands on with the ProtoArc EM25 affordable ergonomic mouse On the gaming side Learn about upcoming game releases, Xbox rumors, new hardware, software updates, freebies, deals, discounts, and more. If you plan to purchase a new Xbox, it's time to act now. This week, Microsoft announced yet another Xbox price increase. Starting August 1, 2026, all Xbox Series X|S models with 512 GB of storage will cost $100 more. As for the 1TB models, they are going up in price by a whopping $150. Finally, Microsoft is discontinuing the 2TB Xbox Series X. To make up for that, Microsoft announced a few programs to make its consoles more accessible. Those include BNPL, interest-free financing, pre-owned consoles, certified refurbished consoles, and more. Valve also shared some not-so-welcome news. The company has finally announced prices of the upcoming Steam Machine console, and if you plan to buy one, get ready to spend a whopping $1,049 on the 512GB configuration. The Steam Machine is now available for preorder, with shipments scheduled for June 29, 2026. Grand Theft Auto VI also received its official price tag. Rockstar Games announced that the long-anticipated game will launch at $79.99 for the base edition and $99.99 for the ultimate edition. The latter includes an exclusive collection of premium vehicles, weapons, apparel, and action threaded across all aspects of Jason and Lucia’s story." Those who preorder the game will get extra bonuses, including a Vintage Vice City Pack of cosmetic items as well as a free month of GTA+. NVIDIA announced new games for its GeForce NOW streaming service. Those include Dark Scrolls, SAND: Raiders of Sophie, Deer & Boy, EMPULSE, and more. Steam is running its annual Summer Sale, during which you can purchase plenty of various games with big discounts. It runs until July 9, so in case you missed it, you can still get some games at a lower price. Also, you can get two games for free in the Epic Games Store, plus more deals are available in this week's Weekend PC Game Deals issue. This link will take you to other issues of the Microsoft Weekly series. You can also support Neowin by registering for a free member account or subscribing for extra member benefits, along with an ad-free tier option.
    • New PowerToys update fixes memory leaks and other issues

      By Steven P. · Posted

      Text extractor hasn't been working great on 0.99.1 but I am now updating to this version, hopefully it's better!
    • The Trump administration doesn't want you to use OpenAI's GPT-5.6 without its approval

      By monterxz · Posted

      Yet you did exactly what they wanted you to do - is it better now without "Europrats"? BTW, UK had joined EU (EEC back then) and was one of the leading member states, it never joined Schengen Zone though 😉

  • Recent Achievements

    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      502
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      156
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!