Pistonheads security issue

[thebraketester]

Here's hoping I don't get an instant ban...I'd ask for Mod from our Community to leave this thread in the Lounge so it doesn't get ignored by the majority of the Community. I guess PH/Haymarket employees might feel differently.

For those who use Google Chrome to browse the internet and these forums you might notice in the coming week or so a pop-up appearing as shown in this thread:

http://www.pistonheads.com/gassing/topic.asp?h=0&a...

This will highlight an issue that PH/Haymarket have been aware of for well over a year and have made no progress on fixing it as highlighted in this thread:

http://www.pistonheads.com/gassing/topic.asp?h=0&a...

The short version is that these forums are not secure, especially if you ever login to this site via a public WiFi connection and login using an email address

I beg all users to please change their PH password to a unique one that you don't use for any other online accounts, especially online banking.

I know we are often told to use separate passwords for every online account but most people (myself included) ignore this advice from time to time. The problem is that PH is so unsecure in comparison to most other website you might login to that you can be vulnerable to man-in-the-middle and eavesdropping attacks, which can let attackers gain access to your PH account and in-turn your email and other online accounts if you use the same or similar passwords.

Please make sure your PH password is unique to PH so your chances of being hacked are reduced

[Alucidnation]

Links don't work

And don't expect anything to happen.

[thebraketester]

I'm not expecting anything. Just making a point.

[eliot]

http://www.pistonheads.com/gassing/topic.asp?h=0&a...

[thebraketester]

I emailed haymarket. No response.

[The Moose]

I've found it surprising for a while that even for SEO purposes the site isn't secured by SSL

[Second Best]

Thanks for the info. I've taken the relevant precautions.

[Sway]

This is really sticking in my craw.

For years, PH has been trying to persuade members to put increasing levels of information on their profile - from names to car history, and more.

Yet they are showing zero concern for the security of critical data that could have severe implications to members lives.

It would not be difficult for someone exploiting this frankly ste situation by reviewing 'my garage' for indications of high net worth/desirable metal, then targeting those users specifically in order to support identity fraud or targeted car theft.

Yet when notified, it seems absolutely fk all is done and radio silence is observed. Heads in the sand is the only conclusion from the information available.

Luckily, it's pretty obvious I'm worth bugger all, and have always used a different password here compared to anywhere else - it's the seeming complete lack of giving a ste that's really wound me up.

[LaurasOtherHalf]

anonymous said:

[redacted]

I'm not saying it couldn't happen, but that sounds like sensationalism.

Also, can we not just update our PH login to something unique and random?

[Sway]

LaurasOtherHalf said:

anonymous said:

[redacted]

I'm not saying it couldn't happen, but that sounds like sensationalism.

Also, can we not just update our PH login to something unique and random?

I'm no techie, but IT Security chap at work is actually very good at explaining some of this stuff to us disinterested office bods.

You'd be amazed at how many people routinely check out as much about the parallel traffic on whatever network they're connected to. As it's completely invisible to the user, it becomes a little like the US and guns - whilst a relatively small number of people actually carry, it's a large enough number that the police have to act as though everyone does. Sounds like paranoia, but the implications are big enough to treat it as healthy rather than disorder.

[buggalugs]

SSL doesn't stop someone from dumping the database and getting all the passwords anyway, which is how 99.9% of passwords get stolen in the real world. Lets not get all emotional about this.

[Rawwr]

buggalugs said:

SSL doesn't stop someone from dumping the database and getting all the passwords anyway, which is how 99.9% of passwords get stolen in the real world. Lets not get all emotional about this.

Both statements are, of course, correct. However, Pistonheads isn't helping itself here. A site this size, which doesn't bother with the most basic of security on the front-end does make me wonder what security is like on the back-end.

You see a house with a front door which is battered and hanging off at the hinges, do you really think that inside they're going to keep their valuables in an impenetrable safe?

They're making themselves a target for compromise by being visibly inept.

[Rawwr]

On another note, once Haymarket get fined into the ground by failing the GDPR, all this will seem moot as PH won't exist anymore.

[bitchstewie]

LaurasOtherHalf said:

I'm not saying it couldn't happen, but that sounds like sensationalism.

Also, can we not just update our PH login to something unique and random?

It really isn't. If you're on any network all your traffic is visible either to other users or to the owner of the network.

So then you're into how well that traffic is secured i.e. is it encrypted or can someone simply "sniff" the traffic and see a request from your PC to an address, followed by a login as "LaurasOtherHalf" followed by "MySharedPassword".

Let's assume they see that.

Let's also assume you've signed up using laurasotherhalf <at> gmail.com as an email address and your Gmail password is also "MySharedPassword".

Someone can now login to that site and look at your profile and see that your email address is laurasotherhalf <at> gmail.com and they can go try and login using "MySharedPassword".

You've just gone from "Well it's only an internet forum" to "Digital life and chunks of real life really fked up" in about 30 seconds.

Now as you say you can just update your password to something unique and random, and you can set things like your Gmail to use a second factor, but you only have to look in the Computer forum to realise that most people are massively unaware about this kind of issue and reuse passwords across multiple sites and still cling on to the old POP3 Freeserve email address they had 15 years ago because "it's too much hassle to change".

[buggalugs]

Rawwr said:

Both statements are, of course, correct. However, Pistonheads isn't helping itself here. A site this size, which doesn't bother with the most basic of security on the front-end does make me wonder what security is like on the back-end.

You see a house with a front door which is battered and hanging off at the hinges, do you really think that inside they're going to keep their valuables in an impenetrable safe?

They're making themselves a target for compromise by being visibly inept.

I'm sure petrol ted's 15 year old ASP is completely impenetrable

To be fair it is a little surprising that they haven't done it considering it's 2017 and all, what's the betting it's their advertising providers holding it up... I understand browsers are going to start displaying prominent warnings on non ssl login forms soon so I think that will force the issue.

[bitchstewie]

buggalugs said:

I understand browsers are going to start displaying prominent warnings on non ssl login forms soon so I think that will force the issue.

As of today Chrome does (Chrome 56 has been released).

[Big Al.]

Thread already stickied in THIS FORUM here:-

http://www.pistonheads.com/gassing/topic.asp?h=0&a...