Zikula Community

• **unknown user**
  
  

  • Rank: Softmore
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 126

  Posted: Apr 10, 2005 - 05:55 AM

  Postnuke should include some protection against Man-In-the-Middle and port sniffer attacks. Currently, postnuke sends plaintext username and passwords making it all to easy for anyone with a port sniffer (like ettercap or ethereal) to see the username and password. (if you don't believe me, i can take some screenshots to show you)
  
  My suggestion is:
  postnuke should use javascript (when available) to encode the user name and pass word before sending. There is a javascript md5 library available at http://pajhome.org.uk/crypt/md5/index.html which was released under the BSD license.
  
  For a live example, see http://login.yahoo.com

  • 
  •  
• **unknown user**
  
  

  • Rank: Helper
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 877

  Posted: Apr 10, 2005 - 01:18 PM

  Man in the middle? I've had dreams about that ...

  • 
  •  
• **unknown user**
  
  

  • Rank: Freshman
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 68

  Posted: Apr 14, 2005 - 05:01 PM

  thats not a bad idea ^_^ a small rewrite to the login system blam there u go ^_^
  
  once i got the my new postnuke is up again I will give this a try ^_^

  • 
  •  
• **unknown user**
  
  

  • Rank: Softmore
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 126

  Posted: Apr 15, 2005 - 07:45 AM

  for a good overview, examples, and the javascript library,
  see http://pajhome.org.uk/crypt/md5/chaplogin.html

  • 
  •  
•  
•  

Users on-line

• bronto

This list is based on users active over the last 60 minutes.