SoSuave security problem

[Oscar Wilde]

This site allows another user from the same IP be auto logged in w/o giving a password. This allows the 2nd user to access all PMs and other private info.

This needs to be disabled yesterday. At least turn on the "cookies required" option.

See http://www.sosuave.com/vBulletin/showthread.php?s=&postid=320783#post320783

Osc.

 

[Demon]

Fix: Logout.

 

[Oscar Wilde]

Originally posted by Demon
Fix: Logout.

That's not a fix, that's a workaround. And it's crap. What if another person comes through the proxy while you're online? I'll tell ya - you're screwed.

This is a major problem within the IT security market - people do not realise the importance of making security easy and accessible.

 

[Demon]

You're paranoid. This is SoSuave.com not <youronlinebank.com>.

 

[HMbroken]

Can two people from the same IP log on at the same time?

 

[Oscar Wilde]

Originally posted by Demon


You're paranoid. This is SoSuave.com not <youronlinebank.com>.

Sure, and you're a naive 17 year old

And yes, in general I am paranoid - part of my job. But not in this case. I have seen this exploited* with unfortunate results.

(* maybe the wrong phrasology - the incident was unintentional).