Waraxe IT Security Portal

linzi · Beginner

when i recived a letter from the forum of waraxe,i found the password is not encrypted.that is not secrity.

if someone hacked the mail of targe.he can use getpassword to get the password of forum.

i think the forum shold encrypt password,maybe md5 is a good choice.

u can connect me by msn linzihk@hotmail.com

g30rg3_x · Active user

i think its most problem of the user who gets hack...
than the board configuration, and i dont think it is a risk...

normally all CMS, email the user with his username and his password and in my personal way to see if not any type of risk, because i ever recive this type of mail and all they come with no encryption of the password and i most think that this is a completly not a risk...

i think its problem for the user who gets hack and hi leave the mail of his registration in his box, and if you think about sniffing, well its a good point but i never use the same password for my mail and forums login in...

grettings from mexico

waraxe · Site admin

This website is based on phpnuke engine. It is heavily rewritten by myself, but password handling subsystem is right now same as in case of phpnuke - md5 based. Real password is sent by email only once. After that you can't reveal it, you can only change it. Even admins can't see real passwords, only hashes.

shai-tan · Valuable expert

Hey Linzi how many sites have you signed upto on the net? 9/10 sites that you register for send you your plain-text password to your email and its upto you to make sure you dont hand your email passwords out.

Shai-tan

linzi · Beginner

maybe u r all right.this is not a risk.

but let's take a look a case about how i get my friend's chat tools

password.

OICQ(QQ) is a very popular chat tools in china,just like msn.

Target:My Friend A

My target is to get his QQ password.

First I chat with him,n give him a movie website.(the movie website hv under my control)

n he registe a account.after he registed,i download the database of movie

website n found what the password he registed.

at last use the password he registed to login his QQ.

the result is that i was successful.

i want to say:although that is not a risk,but attacker can collect user's

password gather by the forum.

i think the forum only sends username that is more secrity than send

usernam+password.

shai-tan · Valuable expert

Thats where it all comes down to a matter of trust doesnt it. Normally web masters would be too busy to bother with anyone's passwords. Wheres the fun/challenge in that?
Thats why you should use different passwords for your online browsing and personal emails/accounts.

Shai-tan

y3dips · Valuable expert

thats the risk u must get long with, but sometimes u have a choice not to get an email by not selecting the options (in some CMS) , but sometimes the sites need some activation n this made u need to get an email info about ur password & surname , so ??