4 ms·
Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profil
by MertsA 11y ago
Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profile. However, that link was also his entire session. Once in the profile section it would let you change the password without knowing the current password. And the last kicker, the change password box had asterisks in it on page load and a quick "view source" revealed my friend's "not joking" password all from a link that didn't look too important.
In summary:
1. Having a session id just stored in a GET variable for (most?) pages.
2. Use of http on profile edit page.
3. Allowing password change without reauthentication
4. Storing of all passwords without any form of hashing.
5. Sending passwords over http every time the profile edit page was viewed
6. Very easy for a user to accidentally share confidential data.
I want to say this was back in 2008 and the site was launched in 2001. I can't imagine that they are making any of these mistakes today but if the past incompetence has any relevance then this security disaster was a long time in the making.
- mcphage 11y ago> I had a friend that jokingly made an account "a friend"
- MertsA 11y agoHad it not been a friend I would have assumed as he did that the session id wasn't just slapped in the URL. What was great was when I sent him back "f1reball" and nothing else and he didn't believe that I could have possibly gotten that from the link he sent me.
- larrywright 11y agoI have a common gmail address, and as a result, it frequently gets used to sign up for things by people who are confused about their email address. In particular, there's a guy in South Carolina who signs up for adult hookup/dating sites using my email address. Very frequently I get emails with links in them that allow me, without any authentication, to change passwords, bios, etc. All that to say, I think this is quite common. I frequently use this to my advantage to do things like remove my email address, deactivate accounts, or change the bio to "you shouldn't sleep with me, I can't even remember my own email address."
- minusSeven 11y agoThat was hilarious. Hacking this site shouldn't even be news then.