Neowin Login Not Secure?

[articuno1au]

I was going to say. There's dozens of certified signing authorities that do SSL cert pricing for reasonable money O.o

Comodo will sign a multi-domain cert through namecheap for $91..

http://www.namecheap.com/ssl-certificates/comodo.aspx

[nekkidtruth]

It's humorous that you don't understand that this isn't actually a huge problem, and can only be resolved by purchasing an expensive SSL certificate for 3 servers, or have a free one cry about it being self signed (creating an unnecessary browser alert for my site).

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

[Steven P. Administrators]

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

Don't worry about it :)

[DaveLegg Developer]

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

I think Neobond merely misinterpreted the first post, as not having SSL is something we've discussed in the past (as shown by the link in my previous post)

[GreenMartian]

So...because I found humor in the length of time it took someone on a tech site to notice something such as this, automatically equates to my having no understanding. Ooook.

Ook? Ook. Ook! Ook! (sorry, can't resist.. :p )

On topic, how about setting up a donation page? Then annoy the hell out of your users, a'la Wikipedia?

Or at least have optional secure login using self-signed cert for those worried about sniffing but not too bothered with an extra browser warning?

[articuno1au]

Going to leave this right.. here..

[nekkidtruth]

Don't worry about it :)

My poke wasn't directed at Neowin (staff), it was towards the fact that for the most part the folks that use Neowin are technologically savvy individuals and someone was just coming across this now (Or so it was believed before Dave posted the old thread). When you quoted the length of time, it literally made me laugh. I just found it ironic.

I think Neobond merely misinterpreted the first post, as not having SSL is something we've discussed in the past (as shown by the link in my previous post)

I'm chalking it up to early money brain cloud (for those of you just waking up) and late night brain cloud (for those like me who are just about to come off a 12 hour overnight shift) ;)

Ook? Ook. Ook! Ook! (sorry, can't resist.. :p )

Lol :p

As for the issue, I don't really think it's that big of a deal.

[Mike]

Ones that are fully trusted, and don't create browser alerts yeah.. expensive.

$15 isn't expensive ;)

[DaveLegg Developer]

I think in general, if your traffic is being sniffed, you probably have a bit more to worry about than your Neowin password being stolen

[Steven P. Administrators]

My poke wasn't directed at Neowin (staff), it was towards the fact that for the most part the folks that use Neowin are technologically savvy individuals and someone was just coming across this now (Or so it was believed before Dave posted the old thread). When you quoted the length of time, it literally made me laugh. I just found it ironic.

I'm chalking it up to early money brain cloud (for those of you just waking up) and late night brain cloud (for those like me who are just about to come off a 12 hour overnight shift) ;)

I had just woke up (was on first coffee) :p

[joemailey]

The way I see it, a lot of people use the same passwords for different sites.

I'm pretty sure people do it here.

It's all well in saying use a different password etc etc. but standard users won't do that.

So for a small fee of an SSL cert. I'm sure we could do a whip around and get the cash raised pretty easliy. I'll donate a few dollars no problem :-)

To me sites need to protect the user, just as much as the user needs to protect themselves.

Even if the info isn't that important, some of the stuff could be used for social engineering attacks.

[cork1958]

There was a previous discussion about this here: http://www.neowin.ne...ds-https-login/

Not bad. It's ONLY been 7 years since that topic was started!!

Neowin is right on top of it. Certs ARE NOT that expensice now a days, as has already been pointed out, but with all the issues this site has every time they update the board, certs would only screw it up more, I'm sure! :rofl:

[ashpowell]

So reading a thread and came across this statement

"Even the neowin login page is not encrypted"

Now I thought to myself - that can not be true.. I know the page itself is not fully encrypted, but that is not an issue the sending of the username and password could be using a https post, etc.

So figured I would take a look see.... Oddly enough, the post for the login looks to be in the clear from the page source

	<form action="https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=process" method="post" id='login'>

Now I said -- hmmm, I know a little bit about html, but maybe I am missing something and I am looking at it wrong or something. So I did what I know better and that is looking at network sniffs... So I took one while logging in..

And what you know - my password right there in the clear?? That is not a very safe practice... I know its only a forum and such, and I agree you sure don't have to encrypt the whole site - but not the sending of the username and password?? That needs to be corrected!!

Now my password is complex random - but I assure you it was in the clear.

Not sure what that auth part is there I highlighted, but hid it as well.

So am I correct in that everyone that is logging into neowin is sending username and password in clear??

Off-topic a bit, but how did you do that? I'd like to test a few sites

[HawkMan]

So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.

you'd think the fact that the passwords are stored in clear text would be the real worry here.

How many people's clear text passwords could someone steal by hacking the neowin database. but at least neowin is secure and always running the latest up to date IPB version so there should be no worries of that... ;) :p

[Steven P. Administrators]

So why did this turn into a SSL discussion, when the cheaper and easier solution that also doesn't nag about the site being mixed https and http so to simply encrypt/hash/salt the password before sending. and not store the clear text password in the database.

you'd think the fact that the passwords are stored in clear text would be the real worry here.

How many people's clear text passwords could someone steal by hacking the neowin database. but at least neowin is secure and always running the latest up to date IPB version so there should be no worries of that... ;) :p

Erm, except it's not US sending cleartext passwords, it is the person logging in sending a password that could be sniffed with a keylogger or something. Our member passwords are encrypted/hashed/salted on our servers.

[Nick H. Supervisor]

On topic, how about setting up a donation page? Then annoy the hell out of your users, a'la Wikipedia?

We already have a donations page. Except we don't call those people donors, we call them subscribers. ;)

[DrakeN2k]

I believe SSL this should be added or HTTPS , note: im not tech savy with the web.

[Steven P. Administrators]

This needs to be sorted , every other day sites and people get hacked this is not helping , if neowin gets hacked how many 1000s of people details will be lost.

I know this is just you to the server problem.

As I already pointed out, nothing about your password is stored on our servers as plain text, What YOU send however could be picked up by network sniffing, just like someone could steal your phone and then call any of your contacts on it (if the phone was unlocked).

[DrakeN2k]

As I already pointed out, nothing about your password is stored on our servers as plain text, What YOU send however could be picked up by network sniffing, just like someone could steal your phone and then call any of your contacts on it (if the phone was unlocked).

After i read your post above i edited my post , sorry for not reading the whole thread before i posted.

[Steven P. Administrators]

After i read your post above i edited my post , sorry for not reading the whole thread before i posted.

No worries :)

[GreenMartian]

We already have a donations page. Except we don't call those people donors, we call them subscribers. ;)

Some people might 'donate' more if they know the money will be going towards certificate signing. I, for one, would.

But looking at the comments here, this seems unlikely to happen..

[Ambroos]

Or secure yourself and sign in using Facebook or Twitter. As an added bonus you only need to sign in once and you can log in to many sites without having to enter anything at all.

But I agree, logging in should really go over SSL. Certificate cost shouldn't be a problem, RapidSSL's certificates are perfectly fine and trusted in all browsers and operating systems and only cost $49 for neowin.net or $199 for *.neowin.net. That shouldn't be too hard.

Your password can't just get sniffed on your computer but on any public network you connect to. When our school's WiFi wasn't secured we could sniff hundreds of passwords in a few minutes by just launching a Firefox plugin. You can't completely secure yourself as a user, but when Neowin decides to let logins go over SSL you are perfectly fine.

It's 2013 now, we've come to a point where even regular Google searches happen over SSL. Any site where you can only login over an unencrypted connection should be banned from the internet.

[+BudMan MVC]

To be honest, I do find it funny that it has not come up since that 2006 thread. To be honest, I was in the middle of posting how a site does not have to be fully https to have a secure login in that other thread.. I was quite sure that neowin would be doing the best practice thing of using https for the login portion.

But as always - better check your facts.. And figured I would use the code as example of how its done, etc..

So is this something that is going to be fixed? Could not seem to tell which way this is going.. Now back in 2006 the likely hood of wifi sniff was a lot less, not everyone was on a tablet surfing the web whenever and wherever, etc.. But as mentioned, in 2013 there is a browser addon to gather such info ;)

I normally don't like using fb or twitter logins - but if they are secure I might have to switch. Is there a actual openid method of logging in?

[Ambroos]

Only Facebook and Twitter for OAuth logins...

[HawkMan]

Erm, except it's not US sending cleartext passwords, it is the person logging in sending a password that could be sniffed with a keylogger or something. Our member passwords are encrypted/hashed/salted on our servers.

So it's the USERS fault that your login page doesn't pre-encrypted/hashed before being sent, or using SSL.

a keylogger is kind of invalid argument since at that point your computer is already fully compromised and it doesn't matter where it's encrypted unless you have a keyboard with a TPM chip that encrypts the password before the computer sees it, which is kind of unreasonable and besides the point :)

point is the password can be hashed client side before they're sent without "expensive" SSL certs.

As it is, even if they're not stored as clear text, someone could inject bad code to your site, and have all the cleartext passwords sent to you every day passed on .