Forum Bugs & Suggestions (12 Viewers)

[Marty]

Testing my fix for Tapatalk bug where it includes the thread title in each post.

- - - Updated - - -

Weee!

 

Buy on AliExpress.com

[enzo]

Why doesn't the forum support SSL? It really should. Can we do something about this Marty?

 

[Martin]

Why doesn't the forum support SSL? It really should. Can we do something about this Marty?

What exactly are you worried about? Man in the middle attacks?

 

[Marty]

Why doesn't the forum support SSL? It really should. Can we do something about this Marty?

Sure it can, I've setup plenty of sites with SSL in the past. I would have to get a new dedicated IP (moneyz) and a SSL certificate (more moneyz) though for it to be setup properly. Too expensive for something that's not really needed IMO.

Not at this moment anyway, might look into it for Juventuz version 14 or whatever's next

 

[Enron]

We'll have another "fundraiser" in 2013.

 

[Marty]

We'll have another "fundraiser" in 2013.

No doubt

 

[swag]

What exactly are you worried about? Man in the middle attacks?

Seriously. Who is making bank transactions via their forum posts? Worried about someone stealing your vCash?

 

[Martin]

Seriously. Who is making bank transactions via their forum posts? Worried about someone stealing your vCash?

I think he confused Juventuz with Second Life. If not Bitcoin

 

[swag]

Yeah, I guess who wouldn't be pissed if they reached a level 17 Janna, only to have someone steal their Scepter of Indecipherable English overnight. :frown:

 

[enzo]

What exactly are you worried about? Man in the middle attacks?

Seriously. Who is making bank transactions via their forum posts? Worried about someone stealing your vCash?

Well, it's just to easy to spy on one's password. But I understand, that this seems to be no common concern here

 

[Marty]

Well, it's just to easy to spy on one's password. But I understand, that this seems to be no common concern here

Since it's so easy to spy the passwords I'll give you my permission to send me a PM with my password. You need my personal salt as well which will be pretty hard to guess, almost impossible really. Even if you knew my salt it would be difficult since MD5 hash isn't reversable.

And it's encrypted, not once, but twice with MD5.

The firewall will stop you when you try to guess the salt with brute force scripting though (only way to get it without database access) and that'll deny you through iptables (ip ban).

Should this happen you can e-mail me (martin at nathell . com) and I'll remove the ban.

If you have a few thousand available ips and a lot of time (years, really, no joke) and know what you're doing, it might be possible to get hold of it.

The easier option of course would be just to guess my password but then it doesn't matter if we're using SSL or not.

BTW I'm not trying to be an asshole, just stating that it's pretty difficult to do, at least it takes a lot of time.

Info: All accounts are double encrypted with MD5+salt, not just mine.

 

[Martin]

Since it's so easy to spy the passwords I'll give you my permission to send me a PM with my password. You need my personal salt as well which will be pretty hard to guess, almost impossible really. Even if you knew my salt it would be difficult since MD5 hash isn't reversable.

And it's encrypted, not once, but twice with MD5.

The firewall will stop you when you try to guess the salt with brute force scripting though (only way to get it without database access) and that'll deny you through iptables (ip ban).

Should this happen you can e-mail me (martin at nathell . com) and I'll remove the ban.

If you have a few thousand available ips and a lot of time (years, really, no joke) and know what you're doing, it might be possible to get hold of it.

The easier option of course would be just to guess my password but then it doesn't matter if we're using SSL or not.

BTW I'm not trying to be an asshole, just stating that it's pretty difficult to do, at least it takes a lot of time.

Info: All accounts are double encrypted with MD5+salt, not just mine.

You don't enjoy being challenged, do you Marty?

 

[Marty]

You don't enjoy being challenged, do you Marty?

I guess I did sound like an asshole after all

 

[Martin]

So to recap. vbulletin has the hashed salt in context, then it takes your password from the input box, hashes(hashed_salt + password) and posts to the server? Sounds reasonable.

- - - Updated - - -

Actually vbulletin has been md5suming the password in js for a long time now. I'm actually surprised that a lot of other webapps aren't doing the same.

 

[Marty]

So to recap. vbulletin has the hashed salt in context, then it takes your password from the input box, hashes(hashed_salt + password) and posts to the server? Sounds reasonable.

- - - Updated - - -

Actually vbulleting has been md5suming the password in js for a long time now. I'm actually surprised that a lot of other webapps aren't doing the same.

Yup correct. I think the personal salt is updated when you change password as well.

 

[Red]

I see that URLs aren't automatically being made into links when you post them now.

Any chance of changing that back to the way it used to be?

 

[Marty]

I see that URLs aren't automatically being made into links when you post them now.

Any chance of changing that back to the way it used to be?

Hmm where? I haven't made any changes to how links work afaik

 

[Red]

Napoli match thread.

Seems to work fine in this thread.

 

[Marty]

Napoli match thread.

Seems to work fine in this thread.

Dem garbage men must have collected the links

 

[enzo]

Since it's so easy to spy the passwords I'll give you my permission to send me a PM with my password. You need my personal salt as well which will be pretty hard to guess, almost impossible really. Even if you knew my salt it would be difficult since MD5 hash isn't reversable.

And it's encrypted, not once, but twice with MD5.

The firewall will stop you when you try to guess the salt with brute force scripting though (only way to get it without database access) and that'll deny you through iptables (ip ban).

Should this happen you can e-mail me (martin at nathell . com) and I'll remove the ban.

If you have a few thousand available ips and a lot of time (years, really, no joke) and know what you're doing, it might be possible to get hold of it.

The easier option of course would be just to guess my password but then it doesn't matter if we're using SSL or not.

BTW I'm not trying to be an asshole, just stating that it's pretty difficult to do, at least it takes a lot of time.

Info: All accounts are double encrypted with MD5+salt, not just mine.

I was thinking of people accessing the forum while connected to public networks. But you are right, and have made it inevitably clear, that it's pretty hard to hack one's password. I wasn't aware of how vbulletin stores and handles password. If I get you, it's encrypted as follows: MD5(MD5(Password), Salt), right?