Internetworkers: http://www.ibiblio.org/internetworkers/

[zman <zman AT gibbon.kungfumonkey.com>]

i think they are showing a disregard for your security. I would highly
recommend contacting them again strongly suggesting SSL or consider going
elsewhere. As for the seperate CGI directory for your account, that's
pretty standard when you doing multiple accounts, and is nothing to worry
about. But the plain text login/password is just plain silly. Silly I tell
you.

On Thu, 26 Dec 2002 machett AT ibiblio.org wrote:
> Greetings, all.  Hope the holidays are joyful for everyone.
> I have a sysadmin question, or series of questions, for whomever can help 
> me.  Although I have enjoyed the commercial hosting company I use, it has 
> suddenly come to my attention that their security might be severely 
> lacking. If true, this would be a disappointment, but would be reason to 
> dump them. Not having a firm grasp of the cgi process, I need someone 
> else's opinion.
> At the end of this message is their response and my original request, but 
> I'll paraphrase here:
> While working with their gui Unix interface (my first mistake, I realize; I 
> should ssh into my account and do these things on my own, but I *really* 
> like a gui, and I had (apparantly falsely) believed their interface to be 
> secure) and while composing web based email, I noticed the following:
> (1)the urls contained, in plain text, my userid and password:
> Example:
> http://helpbot.com/cgi-bin/cgiwrap/lower/brain.cgi?&userid=NNNNN&password=XXXXX
> (2)the page source code contained, in plain text, my userid and password
> Example:
> <INPUT TYPE="hidden" NAME="username" VALUE="NNNNN">
> <INPUT TYPE="hidden" NAME="password" VALUE="XXXXX">
> (3)I hadn't really thought about it before, but a friend pointed out to me 
> that I have my own cgi-bin in my home directory.
> The rather lax response has me a bit worried, also.  What does anyone think?
> --Alan
> >Well, we've had it this way for five years and have never had a problem
> >with it - generally the pages aren't cached, but if it worries you you
> >can simply close your browser when done - it should be set to no cache.
> >--
> >Jen Bryan
> >DrakNet Support Pages
> >http://www.drak.net/support
> >---- Original message ----
> >> Hey, all!
> >> It's late here on the East Coast, so maybe my brain isn't working
> >> right and I'm overlooking something...
> >> anyway, I was just futzing around with Brain and the webmail and I
> >> noticed a few things:
> >> - in the source code for this very page [compose webmail]
> >> appear, in plain text, my user name and password.
> >> - after conducting a transaction with Brain, I noticed that my user
> >> name and password were in the cgi append to the url up in the address
> >> bar, again in plain text
> >> - and examination of the source code for a page with Brain also shows
> >> my user name and password in plain text
> >> shouldn't there be encryption somewhere along the way? I mean, if I
> >> look at the source code, shouldn't I see ********** or g93nZv#43$
> >> instead of the actual password? The only reason I ask is that I can
> >> recall times I've logged into Brain from a public terminal. And what
> >> if I check webmail from a public terminal? I'm very concious of
> >> logging out and quitting programs when I'm finished at such places,
> >> but the examples above would appear in the cache or history files on
> >> such systems. I'm not too worried that there's somebody out there
> >> skimming those files for my login and password, but the potential is
> >> there.
> >> okay, again it's late, so am I completely paranoid delusional about
> >> this or is it a legitimate concern?
> >>
> >> thanks!
> >> Alan
> >>

-- 
Scott H. Zekanis
zman AT kungfumonkey.com
scott AT thehellbenders.com
http://www.thehellbenders.com
1957 Buick Riviera Hardtop (2 dr., 364" Nailhead)
1951 Kaiser Henry J (4" chop, 60's custom front end, bellybutton)