Topic: Autologin and passwords... (Page 1 of 1)

I just noticed that the password when the site automatically "logs in" is located in the password input in a very accesible way. It may be just a bit of paranoia, but I certainly wouldn't want my password to be located in such an easy way.

I know that the page is automatically generated with PHP, but someone (read, a bored hacker, or something) who may be able to access my comp can see my password.



__________________________________


Sexy Demoness cel

or install a keylogger.

Once he's in front of your machine, you've lost anyhow.

well, for the system to be able to put your password automatically into the password field it has to be either stored in your cookie or as in a reversible encryption in the database, right? Doesn't this make it a hell of a lot less secure (and more likely to be intercepted) than if once it registered your session it simply didn't have the fields appear and just continued with the previous session?

it just doesn't matter. Having a session key would give the hypothetical 'in-front-of-your-machine' attacker excat the same amount of leverage that your password does.

Of course, that's why it is an option

Convenience vs. security is a balance each person must undertake for themselves....

True points all.

Well whenever I posted I received a information that I had either a wrong user name or wrong password so everytime I muss give my password - I find it quite funny

Make my day and give me a smile

How do you log out?

Can't find my way outta here!!

This is one craaaaaaaaaaaazy place
in here.

Why am I here?
Why am I??

You are not logged in.

So there is nothing to log out of.

In like Flynn, you only 'log in' when you post, and only for the purpose of asserting your identity for the post. If you click 'Forget about me' below your password (and if paranoid, clear passwords and form data) then you will no longer see your username and password in the post box.

While viewing these pages, you are not logged-in. When you post, you are not logged-in either - just verified.

At least, I think that's right. *looks to the real Maniacs for confirmation*

Interesting...

-Faith
afaith.com

Are you satisfied now? - dont worry be happy

Make my day and give me a smile