Re:Login Forms Over HTTPS, Please
by joosters on Friday January 29, 2016 @10:39AM
(#10995766)
Betfair is finally using all https. Their security was terrible because once you logged in, the site went back to http again. This meant that anyone on the same network could grab your cookies and take over your account...
[ Parent
| on HN ]
That's not the half of it - if you knew what that cookie contained…
Like... login and cleartext password, to lookup your profile on each request?
$sql = "select * from user where username='".$_COOKIE['username']."'";
Came across this last year... have seen variations of it over the last 15+ years, but saw it in 'new' code last summer. :/
Sad reality of rising kids with the notion that security is about forms and passwords and not about hacking stuff.
Re:Login Forms Over HTTPS, Please
by madeofpalk on Friday January 29, 2016 @08:28PM
(#11000025)
Isn't betfair the one where the password reset email was sent to the email in a hidden input field which you could change yourself....?