VB credentials sent in plain text?

[Rubycon]

I know the site does not have SSL so I've probably answered my own question.

Can someone sniffing get creds here?

 

[SunnyD]

I believe the actual password is hashed client side and the hash is sent, but yes, in the clear.

But honestly, if you're using the same password here you're using on your "important" personal accounts (banking, etc), you have bigger problems to worry about.

 

[Rubycon]

I believe the actual password is hashed client side and the hash is sent, but yes, in the clear.

But honestly, if you're using the same password here you're using on your "important" personal accounts (banking, etc), you have bigger problems to worry about.

Heck no! Matter of fact that really isn't allowed due to some international law but that's another thing altogether. This is a concern in an another direction.

 

[Spacehead]

User names are in the clear, passwords are MD5 hashed.

http://forums.anandtech.com/showthread.php?t=2056786

 

[Red Squirrel]

I just sniffed and I can confirm there is some kind of client side hashing that goes on before it sends the password, and the hash value does not match the one for the cookie. Otherwise one could sniff that and just add their own cookie.

 

[Crusty]

I just sniffed and I can confirm there is some kind of client side hashing that goes on before it sends the password, and the hash value does not match the one for the cookie. Otherwise one could sniff that and just add their own cookie.

If your web browser has javascript enabled you will use an MD5 hash on your password before you submit it, otherwise your password is sent in clear text.

Having either one is enough to gain access to to this site.

 

[Red Squirrel]

If your web browser has javascript enabled you will use an MD5 hash on your password before you submit it, otherwise your password is sent in clear text.

Having either one is enough to gain access to to this site.

Actually yeah one could simply just submit the MD5 value in the proper POST field to log in.