Buy.at login link - login and password showing

[monkeyman]

This hasn't shown before, but your email and password now appear in the url.

Now, not so sure about that being particulary secure. :eek:

Surely URL's get written to the httpd logs?

PHP Code:

https://users.buy.at/menu/index.php?EMAIL=me@me.com&PASSWORD=yourpassword&MA=LINK 


Link above

[Supercod]

It's always been that way since the start. As long as you don't click any external links you will be fine.

[monkeyman]

Has it?

Have only just noticed it.

Doesn't really inspire me with confidence though.

[leec]

Ive never noticed that before?


Maybe i never looked hard enough

[Rovin Dawson]

We are aware of this issue and will get back with some more info, in due course. Suffice to say, we take security seriously and will endeavour to resolve this. As part of the ongoing development the buy.at network, we are constantly looking to improve our technology.

I'll keep you posted.

Regards,

Rovin

[Supercod]

Originally Posted by monkeyman Has it?

Yes, don't just make up reply's you know but I was talking about it always being in the address bar when you log in via a link and not via the direct site.

Here is a post from 2003 that backs it up.

http://www.a4uforum.co.uk/showthread.php?t=11776

Note that "If you login from our site, the password is never displayed in the address bar. It is only displayed if you login by the method shown above." But I checked login direct from main site today and it's showing in the URL that way also.

Maybe they are in the middle of trying to fix this http://www.a4uforum.co.uk/showthread.php?t=33190 as that still happens a lot.

[Rovin Dawson]

Hi,

I'm afraid the error was in part due to us putting live a new Jump page ahead of the Management Area version 3 being released. Apologies for this brief error.

However, please read the following forum for the exciting news of the MA V3.00 launch!

http://www.a4uforum.co.uk/showthread...125#post288125

Best regards

Rovin