Skip to Content.
Sympa Menu

internetworkers - [internetworkers] man Unix

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: machett AT ibiblio.org
  • To: internetworkers AT lists.ibiblio.org
  • Subject: [internetworkers] man Unix
  • Date: Thu, 26 Dec 2002 13:31:20 -0500

Greetings, all. Hope the holidays are joyful for everyone.

I have a sysadmin question, or series of questions, for whomever can help me.
Although I have enjoyed the commercial hosting company I use, it has
suddenly come to my attention that their security might be severely lacking.
If true, this would be a disappointment, but would be reason to dump them.
Not having a firm grasp of the cgi process, I need someone else's opinion.

At the end of this message is their response and my original request, but
I'll paraphrase here:

While working with their gui Unix interface (my first mistake, I realize; I
should ssh into my account and do these things on my own, but I *really* like
a gui, and I had (apparantly falsely) believed their interface to be secure)
and while composing web based email, I noticed the following:

(1)the urls contained, in plain text, my userid and password:
Example:
http://helpbot.com/cgi-bin/cgiwrap/lower/brain.cgi?&userid=NNNNN&password=XXXXX

(2)the page source code contained, in plain text, my userid and password
Example:
<INPUT TYPE="hidden" NAME="username" VALUE="NNNNN">
<INPUT TYPE="hidden" NAME="password" VALUE="XXXXX">

(3)I hadn't really thought about it before, but a friend pointed out to me
that I have my own cgi-bin in my home directory.

The rather lax response has me a bit worried, also. What does anyone think?

--Alan


>
>Well, we've had it this way for five years and have never had a problem
>with it - generally the pages aren't cached, but if it worries you you
>can simply close your browser when done - it should be set to no cache.
>--
>Jen Bryan
>DrakNet Support Pages
>http://www.drak.net/support
>
>---- Original message ----
>
>> Hey, all!
>>
>> It's late here on the East Coast, so maybe my brain isn't working
>> right and I'm overlooking something...
>>
>> anyway, I was just futzing around with Brain and the webmail and I
>> noticed a few things:
>>
>> - in the source code for this very page [compose webmail]
>> appear, in plain text, my user name and password.
>>
>> - after conducting a transaction with Brain, I noticed that my user
>> name and password were in the cgi append to the url up in the address
>> bar, again in plain text
>>
>> - and examination of the source code for a page with Brain also shows
>> my user name and password in plain text
>>
>> shouldn't there be encryption somewhere along the way? I mean, if I
>> look at the source code, shouldn't I see ********** or g93nZv#43$
>> instead of the actual password? The only reason I ask is that I can
>> recall times I've logged into Brain from a public terminal. And what
>> if I check webmail from a public terminal? I'm very concious of
>> logging out and quitting programs when I'm finished at such places,
>> but the examples above would appear in the cache or history files on
>> such systems. I'm not too worried that there's somebody out there
>> skimming those files for my login and password, but the potential is
>> there.
>>
>> okay, again it's late, so am I completely paranoid delusional about
>> this or is it a legitimate concern?
>>
>> thanks!
>> Alan
>>





Archive powered by MHonArc 2.6.24.

Top of Page