Travelling On

gallygirl · 10 February 2018 at 1:44PM

ZTD wrote: »

Every request you send is in plain text, and will include a "Cookie" header (this is an example Cookie header, but if you explore your own cookies in your browser, you'll see actual ones).

Cookie: PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1;

If I were to copy that (and since it's unencrypted and less confidential than a postcard - it's easy), and send it on *my* requests - I'd become you. I wouldn't need to "catch" you typing a password, I'd only need you to use MSE - every request you make has it.

But it would only let them capture my MSE password wouldn't it? They're welcome to it if they're that desperate :rotfl:.

I used to know about session & permanent cookies and opting in/out and stuff

.

ZTD · 10 February 2018 at 1:54PM

gallygirl wrote: »

But it would only let them capture my MSE password wouldn't it? They're welcome to it if they're that desperate :rotfl:.

I used to know about session & permanent cookies and opting in/out and stuff .

It wouldn't give them your password (Please God, let them not have encoded passwords into cookies), just to allow them to impersonate you. This just means post "content", send phishing PMs, change your password/email address etc - all as you.

So when it says you shouldn't PM any confidential information and that this site does not have "bank level security" - they're not kidding.

beanielou · 10 February 2018 at 3:30PM

Should we be worried Z.

Enjoy your day Karmcat

ZTD · 10 February 2018 at 5:06PM

beanielou wrote: »

Should we be worried Z.

If this was *actually* an important site, then yes. Their security is poor - I have better security for stuff at work only I use. But this isn't an important site, and being inept and cack-handed doesn't matter all that much.

MSE have previously lost usernames & passwords before (and sat on it for many months) and if GallyGirl suddenly sends you a PM offering you tablets which will give you a "long schlong fresh from Hong Kong, only 20 Dong" - you can safely ignore it and delete.

Just make damn sure you don't give out confidential things over PMs in response to an unsolicited request, and delete such things ASAP if it's not unsolicited.

The annoying thing, is that the hosting platform they use gives https essentially for free (see Https Everywhere), but if you try https, you get shovelled back to http - despite the fact they've bought a certificate and everything.

| ssl-cert: Subject: commonName=*.moneysavingexpert.com/organizationName=MoneySa vingExpert.com Limited/stateOrProvinceName=London/countryName=GB
| Issuer: commonName=GlobalSign Organization Validation CA - SHA256 - G2/organiz ationName=GlobalSign nv-sa/countryName=BE
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2017-01-10T14:11:16
| Not valid after: 2020-01-11T14:11:16
| MD5: 7af0 0597 b5e2 b464 000b 2d8a c113 4f1c
|_SHA-1: 96bc 4e44 7440 c356 fd1b 8e6b cb3e d285 3747 6e62

Goldiegirl · 10 February 2018 at 5:09PM

I had that password thing today as well, glad it's not just me.

hope you are having a good day out KC, although the weather may not be that good

Karmacat · 10 February 2018 at 6:39PM

:wave: Day out was lovely - we spent most of our time in the county craft guild shop, staffed by the individual artists - several pressies were bought for the future

Though as Goldie thought, the weather was diabolical, and the local healthy cafe was so crowded we ended up sitting almost outside, where the coach-and-fours space was :eek: I had hot tea and a to-die-for parmesan twist, with a rocket salad and balsamic vinegar - only in Tourist Town, I tell you :rotfl:

smallholdingsister wrote: »

Are you allergic to the nickel in the fasteners? Painting the with clear nail varnish can help.

Its the zip too, SHS - I can't see that working with the zip

but all potential fixes appreciated

beanielou wrote: »

Enjoy your day Karmcat

Thanks beanie - it was good to get out again, and that town is accessible to me *and* my sister, and contains lots of stuff we haven't done together. Excursions for spring are planned!

ZTD wrote: »

Just make damn sure you don't give out confidential things over PMs in response to an unsolicited request, and delete such things ASAP if it's not unsolicited.

I've no idea what the list of numbers meant, Z, and frankly I'm not keen to find out

:o:o but this paragraph, this I understood the implications. Because I *have* sent out things in pm I meant not to be seen by the wider world - not exactly confidential, but a bit private. No bank codes or anything! I think I'll be deleting pms a lot quicker in future, so this is appreciated, thank you.

ZTD · 10 February 2018 at 6:43PM

Suffolk_lass wrote: »

Mine expired after 23 days - on what planet is eight years 23 days I wonder?

Planet "Big Brother" where 23 days of that tut would feel like a prison sentence...

beanielou · 10 February 2018 at 7:02PM

Yes, like you will be deleting PM's much more promptly.

smallholdingsister · 10 February 2018 at 7:22PM

Is it just me? A long schlong fresh from Hong Kong spounds okay.

ZTD · 10 February 2018 at 7:30PM

smallholdingsister wrote: »

Is it just me? A long schlong fresh from Hong Kong spounds okay.

It probably pounds okay as well... :rotfl:

Travelling On

Comments

Categories

Get our FREE Weekly email full of deals & guides - and it’s spam-free