Internetworkers: http://www.ibiblio.org/internetworkers/

[machett AT ibiblio.org]

Greetings, all.  Hope the holidays are joyful for everyone.

I have a sysadmin question, or series of questions, for whomever can help me. 
 Although I have enjoyed the commercial hosting company I use, it has 
suddenly come to my attention that their security might be severely lacking. 
If true, this would be a disappointment, but would be reason to dump them. 
Not having a firm grasp of the cgi process, I need someone else's opinion.

At the end of this message is their response and my original request, but 
I'll paraphrase here:

While working with their gui Unix interface (my first mistake, I realize; I 
should ssh into my account and do these things on my own, but I *really* like 
a gui, and I had (apparantly falsely) believed their interface to be secure) 
and while composing web based email, I noticed the following:

(1)the urls contained, in plain text, my userid and password:
Example:
http://helpbot.com/cgi-bin/cgiwrap/lower/brain.cgi?&userid=NNNNN&password=XXXXX

(2)the page source code contained, in plain text, my userid and password
Example:
<INPUT TYPE="hidden" NAME="username" VALUE="NNNNN">
<INPUT TYPE="hidden" NAME="password" VALUE="XXXXX">

(3)I hadn't really thought about it before, but a friend pointed out to me 
that I have my own cgi-bin in my home directory.

The rather lax response has me a bit worried, also.  What does anyone think?

--Alan


>
>Well, we've had it this way for five years and have never had a problem
>with it - generally the pages aren't cached, but if it worries you you
>can simply close your browser when done - it should be set to no cache.
>--
>Jen Bryan
>DrakNet Support Pages
>http://www.drak.net/support
>
>---- Original message ----
>
>> Hey, all! 
>> 
>> It's late here on the East Coast, so maybe my brain isn't working 
>> right and I'm overlooking something... 
>> 
>> anyway, I was just futzing around with Brain and the webmail and I 
>> noticed a few things: 
>> 
>> - in the source code for this very page [compose webmail]
>> appear, in plain text, my user name and password. 
>> 
>> - after conducting a transaction with Brain, I noticed that my user 
>> name and password were in the cgi append to the url up in the address 
>> bar, again in plain text 
>> 
>> - and examination of the source code for a page with Brain also shows 
>> my user name and password in plain text 
>> 
>> shouldn't there be encryption somewhere along the way? I mean, if I 
>> look at the source code, shouldn't I see ********** or g93nZv#43$ 
>> instead of the actual password? The only reason I ask is that I can 
>> recall times I've logged into Brain from a public terminal. And what 
>> if I check webmail from a public terminal? I'm very concious of 
>> logging out and quitting programs when I'm finished at such places, 
>> but the examples above would appear in the cache or history files on 
>> such systems. I'm not too worried that there's somebody out there 
>> skimming those files for my login and password, but the potential is 
>> there. 
>> 
>> okay, again it's late, so am I completely paranoid delusional about 
>> this or is it a legitimate concern? 
>> 
>> thanks! 
>> Alan 
>>