Full Disclosure mailing list archives
Re: Any.Do sends passwords in plaintext
From: Peter Lustlos <peter.lustlos84 () yahoo com>
Date: Mon, 3 Jun 2013 16:24:28 -0700 (PDT)
As of recently this security hole has been silently fixed. ________________________________ From: Peter Lustlos <peter.lustlos84 () yahoo com> To: full-disclosure () lists grok org uk Sent: Monday, December 10, 2012 2:57 PM Subject: Any.Do sends passwords in plaintext Any.Do transmits Passwords in plaintext. == Some of you may be interested to know that the Task Management and TODO-list Application, Any.Do, happily transmits your password and just about everything else in plaintext. They were even so kind to include a README.md documenting exactly this "feature": >>> Login
----- * Right now, the only form encoding call done to the server is the login process. * Only POST is supported. * The parameter *_spring_security_remember_me* should always be specified. * Password is not encoded/encrypted in the request. Endpoint: /state-manager/j_spring_security_check POST parameters: { j_username: <email>, j_password: <password>, _spring_security_remember_me: "on" } Just to verify this is actually happening I made use of wireshark:
http://imm.io/ODou
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Any.Do sends passwords in plaintext Peter Lustlos (Jun 04)