4 ms·
For too long popular a lot of popular gambling sites such as betfair and skybet have done this. I think betfair now is all https, but I'm not sure of skybet (an
by eterm 11y ago
For too long popular a lot of popular gambling sites such as betfair and skybet have done this. I think betfair now is all https, but I'm not sure of skybet (and I can't be checking while at work).
- joosters 11y agoBetfair is finally using all https. Their security was terrible because once you logged in, the site went back to http again. This meant that anyone on the same network could grab your cookies and take over your account...
- ajanuary 11y agoThat's not the half of it - if you knew what that cookie contained…
- qb45 11y agoLike... login and cleartext password, to lookup your profile on each request?
- mgkimsal 11y ago$sql = "select * from user where username='".$_COOKIE['username']."'"; Came across this last year... have seen variations of it over the last 15+ years, but saw it in 'new' code last summer. :/
- qb45 11y agoSad reality of rising kids with the notion that security is about forms and passwords and not about hacking stuff.
- madeofpalk 11y agoIsn't betfair the one where the password reset email was sent to the email in a hidden input field which you could change yourself....?