Full Disclosure mailing list archives
Any.Do sends passwords in plaintext
From: Peter Lustlos <peter.lustlos84 () yahoo com>
Date: Mon, 10 Dec 2012 06:57:28 -0800 (PST)
Any.Do transmits Passwords in plaintext. == Some of you may be interested to know that the Task Management and TODO-list Application, Any.Do, happily transmits your password and just about everything else in plaintext. They were even so kind to include a README.md documenting exactly this "feature":
Login ----- * Right now, the only form encoding call done to the server is the login process. * Only POST is supported. * The parameter *_spring_security_remember_me* should always be specified. * Password is not encoded/encrypted in the request. Endpoint: /state-manager/j_spring_security_check POST parameters: { j_username: <email>, j_password: <password>, _spring_security_remember_me: "on" }
Just to verify this is actually happening I made use of wireshark: http://imm.io/ODou
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Any.Do sends passwords in plaintext Peter Lustlos (Dec 10)