Neowin needs HTTPS login from main, not just forums

By boogerjones
in Site & Forum Issues

 Share

Recommended Posts

Grand Master

boogerjones

Posted
Posted (edited)

Some prick sniffed my password at a school computer lab. Is there any way for Neowin to get a secure logon? I know these things cost money, but it's such an easy target for any jackass with a computer. Hell, even a self-generated certificate (not from Thawte, Verisign, etc) would at least give some of us the option of using it.

Edited by boogerjones
Experienced

tiddlie

Posted
Posted

A public PC is always going to be an issue. If this 'prick' had used a USB keylogger / PS2 keylogger, would you want that Neowin implemented a voice recognition login?

I don't see the need for HTTPS login on Neowin. It's a forum - not a financial institution. If its that much of an issue, use a seperate password on things like forums than important things.

Grand Master

boogerjones

Posted
  • Author
Posted

If this 'prick' had used a USB keylogger / PS2 keylogger, would you want that Neowin implemented a voice recognition login?

Gimme a break. Why should cars have locks if keys can be duplicated? Yes, somebody could potentially use a TEMPEST attack and get my password, but these kinds of thieves will use the easiest possible method. And right now it's pretty easy to get my password for Neowin. SSL is a pretty standard implementation for logging in to just about any site.

And I do use a separate password. But the content of the site is not the issue. I really don't care if somebody can login to my profile. But I think it's just a bad security practice on Neowin's end.

Experienced

tiddlie

Posted
Posted

Damn...thats a good point! Cars have locks yet keys can be duplicated....maybe they need some sort of SSL to make them secure. A keypad in each car maybe?

If someone on a public PC wants to get hold of your password, they'll do it. Packet sniffing a network for unsecured passwords is far more difficult than a keylogger, so you'll never be safe.

Talk to someone in your college's ICT department if this is going on there, or only login from home. Its unlikely that any website putting SSL onto their site will have any major benefit to stopping people on public computers being targetted.

I mean can you even be 100% sure that they didn't just have a keylogger installed or something to that effect? Can you be sure that the public machines are 100% trojan secure? It may not even have happened the way you think it did.

There are far far bigger sites out there that don't use SSL connections to login to their servers. Myspace anyone?

Grand Master

Joel

Posted
Posted

Wow, I can't believe all the strong opposition to what is a simple, effective, and potentially free security measure. It has nothing to do with what is stored on Neowin or what the policy of other forums is.

I'm not opposing it so much as I'm asking what use it would be to implement.

Grand Master

John Veteran

Posted
  • Veteran
Posted

Do self-signed certificates get along well with browser security? If the browser doesn't trust a certificate's issuer, then it inherintly does not trust the certificate. Self-signed certificates are their own issuer, which causes issues for situations like this.

Rising Star

nautiqueskier

Posted
Posted

Honestly I think SSL is overkill in this case. A self-signed certificate will give everyone an error everytime they try and login and a trusted signed SSL, while not terribly expensive ($60 for a basic, not wildcard one with virtually no financial backup) would not be money well spent in my opinion.

Then theres the implementation of it into Invision (the forum software Neowin runs)

Grand Master

kjordan2001

Posted
Posted

Do self-signed certificates get along well with browser security? If the browser doesn't trust a certificate's issuer, then it inherintly does not trust the certificate. Self-signed certificates are their own issuer, which causes issues for situations like this.

The browser will prompt you if you trust the self-signed certificate. There's always free signing 3rd parties too like cacert.org. Just import their root certificate and any site signed with that will be trusted.

Grand Master

John Veteran

Posted
  • Veteran
Posted
vBulletin implemented a Javascript hashing mechanism so that user passwords are hashed before they're sent to the server. That could probably be modded into IPB for much less effort.

So instead of someone sniffing your password, they sniff the password hash, which is just as good as a password... Great solution (Y) Whatever is sent to the server needs to be encrypted so it can't be sniffed. That's the whole point. Sending the server "asdf" instead of "password" does nothing if an anonymous listener can see it on the network.

The browser will prompt you if you trust the self-signed certificate. There's always free signing 3rd parties too like cacert.org. Just import their root certificate and any site signed with that will be trusted.

Yeah, every user would have to import SOME certificate, whether it's Neowin's or cacert.org, or whoever's... That's not a solution. Why do you think people pay so much for Verisign certificates? Because they're trusted. I've never heard of cacert.org and certantly don't trust them to vouch for another website...

Grand Master

dragon2611

Posted
Posted

So instead of someone sniffing your password, they sniff the password hash, which is just as good as a password... Great solution (Y) Whatever is sent to the server needs to be encrypted so it can't be sniffed. That's the whole point. Sending the server "asdf" instead of "password" does nothing if an anonymous listener can see it on the network.

Yeah, every user would have to import SOME certificate, whether it's Neowin's or cacert.org, or whoever's... That's not a solution. Why do you think people pay so much for Verisign certificates? Because they're trusted. I've never heard of cacert.org and certantly don't trust them to vouch for another website...

actually i have a starter SSL certificate from namecheap.com setup for cpanel on a server and it cost me a $16 :yes:

its reconised by most browsers, shows up as being signed by Eqifax and works fine with firefox and Ie6+ (maybe older versions of ie also, dont know cus i only run 6 and 7) also works with opera and safari as far as i can remember (dont use them much tend to use firefox all the time)

so no they don't need to cost the earth! ;)

  • 6 years later...
  • 1 year later...
Veteran

vanx

Posted
Posted

Since the other topic was locked, I would post a couple of my observations here:

 

-- The login form for the credentials is served over unsecured HTTP

-- The logout action consists of this URL 

https://www.neowin.net/forum/index.php?app=core&module=global&section=login&do=logout&k=

And the "k" -- I guess that means "key" -- value is a constant 32 char hash that does not vary between sessions. Now I am not a security whiz, but I think that both of those are not good things and should be corrected.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • UK nudity blockers are a looming privacy disaster, we must be able to see the source code

      By ExecutiveFunction404 · Posted

      Wonder what MPs have ties to these privacy/verification/data harvesting companies that are going to step in this time. Last time under the Tories half the cabinet had fingers in the pies, heck even the PM and his wife at the time was working for silicon valley, probably made a fortune.
    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow

      By hellowalkman · Posted

      Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow by Sayan Sen For a while now the transition away from Manifest V2 (MV2) to MV3 has been on-going and it looks like it is entering its final phase of deprecation, at least, in the case of Google Chrome. A recent discussion thread in the w3c WebExtensions Community Group GitHub repo has highlighted how the latest and upcoming versions of the most popular browser are expected to be its final releases with support for MV2 extensions. Chromium contributor Andrey Bershanskiy shared details about recent Chromium changes and according to comments from Google engineer Devlin Cronin, Chrome has now started removing the flags that previously controlled MV2 availability. kExtensionManifestV2Disabled, the Chromium feature flag that allowed controlled disabling of MV2 add-ons, is now completely removed, which means you will likely no longer find uBlock Origin in your browser extensions list. He wrote: "The kExtensionManifestV2Disabled feature has been default-enabled for over a year. Remove the feature and the effectively-dead code. ... Any tests that relied on being in the "warning" phase (i.e., with the kExtensionManifestV2Disabled) for their sole behavior testing are removed, since this stage is no longer reachable." Cronin further explained why MV2 extensions are no longer allowed in supported Chrome versions as maintaining the associated functionality indefinitely is no longer possible. He cited growing technical difficulties and implementation complexities as well as security concerns. He wrote: "MV2 extensions are no longer allowed in any supported version of Chrome, and we are removing support for them and the associated functionality. We won't be able to provide / maintain this functionality indefinitely due to the complexity and tech debt, as well as the security risks it entails (we've actually found a number of bugs that are specific to MV2 lately). Of course, other browsers can continue supporting these if they so desire. Unfortunately, we won't be putting code behind a compilation flag ... We won't be removing all the MV2 code wholesale right away, so many of these things will continue working for awhile (but they will go away eventually, and some may go away sooner than others)." What this essentially means is that the tricks and bypasses that were used to keep MV2 extensions like uBlock Origin and others alive will not work any more on Chrome, or at least not for very long. For example the Windows Registry mod that could extend MV2 availability will cease to function after Chromium version 151. Here is a rundown of the changes coming in the final such releases of Chromium releases: Chromium 150 lost ExtensionManifestV2Disabled option Chromium 151 will loose ExtensionManifestV2Unsupported option Chromium 151 will loose ExtensionManifestV2Availability option Chromium 151 will likely loose AllowLegacyMV2Extensions option Other Chromium-based browsers like Opera and Microsoft Edge could soon follow suit too. Although it is not specified, Edge began disabling uBlock Origin back in February, and Opera could also stop the functioning of MV2 add-ons, even though it had committed to support MV2 for longer in October 2024. uBlock Origin developer Raymond Hill (gorhill) apparently stated the following: "For Opera I did submit 1.70.0 rather late, but this was weeks ago. A while ago I received an email from Opera that they plan to abandon MV2-based extension so maybe they are no longer allocating resources for reviewing such extensions." The email which developers like Gorhill mentions was received from Opera last year. Here is what it seemingly said: Hence for now the only Chromium browser that seems to be on-board fully with MV2 support is Brave, and perhaps Vivaldi as well. Meanwhile if you want to ditch Chromium browsers entirely then Mozilla Firefox is an excellent alternative as MV3 and MV2 are both supported. Of course the easiest solution is to switch to uBlock Origin Lite if you want to remain on Chrome, as it is MV3-based, but from our experience, uBO Lite does not seem to be as good as the original non-Lite version. Source: w3C (GitHub repo) As an online publication, Neowin too relies on ads for operating costs and, if you use an ad blocker, we'd appreciate being whitelisted. In addition, we have an ad-free subscription for $28 a year, which is another way to show support!
    • UK nudity blockers are a looming privacy disaster, we must be able to see the source code

      By ParadiseLost · Posted

      Write to your MP 😄 Like believing in Santa. Total surveillance IS the goal. Wake up.
    • Politically funny images of the World

      By PsYcHoKiLLa · Posted

    • UK nudity blockers are a looming privacy disaster, we must be able to see the source code

      By RejZoR · Posted

      This whole dumb age verification thing needs to die and be replaced by giving parents tools to control devices. Why am I required to plaster my ID all over the internet to prove I'm old enough when parents should be the ones dictating what their kids are doing on their phones. Apple released great set of tools for iPhones coming to iOS 27 that do just that. Why are governments not mandating that kind of control to phone makers to built them into phones. This whole thing is so absolutely idiotic it's wild.

  • Recent Achievements

    • Very Popular
      Captain_Eric earned a badge
      Very Popular
    • One Month Later
      amusc earned a badge
      One Month Later
    • One Month Later
      DJC50PLUS earned a badge
      One Month Later
    • Week One Done
      DJC50PLUS earned a badge
      Week One Done
    • Proficient
      Eric Biran went up a rank
      Proficient

  • Popular Contributors

    1. 1
      +primortal
      511
    2. 2
      PsYcHoKiLLa
      220
    3. 3
      ATLien_0
      92
    4. 4
      +Edouard
      90
    5. 5
      Steven P.
      83
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!