Microsoft disable username / password coding in links :( - GoFuckYourself.com

Sexy Rex · 02-03-2004, 06:53 AM

"The newly announced patch will disable a feature that lets people code a username and password directly into a link so that someone clicking the link can easily access the restricted page to which it points."

http://news.zdnet.co.uk/internet/sec...9145074,00.htm

We were using this feature all over our sites.
Anyone else afected?

arg · 02-03-2004, 06:57 AM

I used it just on my local home page, to log into sponsor sites and such. I figured "no big deal, I'll just use Stats Remote to log in to the sponsor sites," but unfortunately Stats Remote used the same technique.

pornJester · 02-03-2004, 07:01 AM

Not a bad idea...

Ash@phpFX · 02-03-2004, 07:08 AM

thats fucking stupid, why would they do that?

Trax · 02-03-2004, 07:09 AM

yeah
i noticed statsremote use the same
what will they do?
is this a problem at all?

iroc409 · 02-03-2004, 07:33 AM

Quote:

Originally posted by asher
thats fucking stupid, why would they do that?

my guess would be security issues.

J B · 02-03-2004, 07:48 AM

Quote:

Originally posted by arg
I used it just on my local home page, to log into sponsor sites and such. I figured "no big deal, I'll just use Stats Remote to log in to the sponsor sites," but unfortunately Stats Remote used the same technique.

Quote:

Originally posted by Trax
yeah
i noticed statsremote use the same
what will they do?
is this a problem at all?

We are trying to find a solution for this ASAP.

arg · 02-03-2004, 08:00 AM

The reason was that scammers would send people a URL like:

http://www.visa.com:[email protected]/

and fucking nimrods would see "www.visa.com" and enter
their credit card info. I can see why MS wants to cater to
nimrods, but I wish they'd allowed non-nimrods to enable
user:pw@ as an option.

J B · 02-03-2004, 08:10 AM

Quote:

Originally posted by arg
...but I wish they'd allowed non-nimrods to enable
user:pw@ as an option.

They do...

http://support.microsoft.com/default...;en-us;Q834489
---
How to disable the new default behavior for handling user information in HTTP or HTTPS URLs

To disable the new default behavior in Windows Explorer and Internet Explorer, create iexplore.exe and explorer.exe DWORD values in one of the following registry keys and set their value data to 0:

For all users:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME _PASSWORD_DISABLE

For the current user only:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME _PASSWORD_DISABLE
---

arg · 02-03-2004, 08:23 AM

Quote:

Originally posted by J B

They do...

http://support.microsoft.com/default...;en-us;Q834489
---
How to disable the new default behavior for handling user information in HTTP or HTTPS URLs

To disable the new default behavior in Windows Explorer and Internet Explorer, create iexplore.exe and explorer.exe DWORD values in one of the following registry keys and set their value data to 0:

For all users:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME _PASSWORD_DISABLE

For the current user only:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME _PASSWORD_DISABLE
---

Holy crap, silly me just checked the "Internet Options" settings in IE. :-) Thanks. Gotta hand it to MS, no clueless newbs are going to switch on the user/pass thing by accident this way!

Rick Latona · 02-03-2004, 08:41 AM

The funny thing is that I use MicrosoftOffice.com/LiveMeeting to give demos of Dollars.com remotely. The user clicks a link with the username and password coded to enter the software app.

Go Microsoft!

Sexy Rex · 02-03-2004, 09:06 AM

02-03-2004, 09:47 AM

Not good news...

andi_germany · 02-03-2004, 11:25 AM

The security risk is that a user uses that feature and then visits another site from your members section. As referrer you will see the URl including the username and password. I used to surf a lot of porn for free that way ;)

Rictor · 02-03-2004, 11:35 AM

I see a lot of username/passwords in my referrer logs too. People really shouldn't use that feature.

garce · 02-03-2004, 01:07 PM

The update deleted all of my stored passwords, as well. I've spent half the day searching through old emails and printouts.

garce

02-03-2004, 06:53 AM	#1
Sexy Rex Confirmed User Join Date: Sep 2003 Location: President/CEO - iStripper.com Posts: 1,164	Microsoft disable username / password coding in links :( "The newly announced patch will disable a feature that lets people code a username and password directly into a link so that someone clicking the link can easily access the restricted page to which it points." http://news.zdnet.co.uk/internet/sec...9145074,00.htm We were using this feature all over our sites. Anyone else afected? __________________ WWW.ISTRIPPER.COM Unique Desktop Strippers since 1998, 20+ Millions users, 3000+ Girls to choose from, All UHD Exclusive Content.

02-03-2004, 07:01 AM	#3
pornJester Confirmed User Join Date: Mar 2001 Location: Florida Posts: 6,138	Not a bad idea... __________________ FreshBucks \| Webmaster Vault \| GayAW Trusted Names in Adult. ICQ 9157.3698

02-03-2004, 08:41 AM	#11
Rick Latona The Best Ideas Start Here Join Date: Dec 2002 Location: Atlanta Posts: 6,037	The funny thing is that I use MicrosoftOffice.com/LiveMeeting to give demos of Dollars.com remotely. The user clicks a link with the username and password coded to enter the software app. Go Microsoft! __________________ Regards, Rick Latona http://latonas.com Latona's - We Sell Money Making Web Properties Note to buyers of websites and traffic: please check our inventory at http://latonas.com/websites-for-sale. If you would like to make an offer on something, just let me know.

02-03-2004, 09:06 AM	#12
Sexy Rex Confirmed User Join Date: Sep 2003 Location: President/CEO - iStripper.com Posts: 1,164	lol __________________ WWW.ISTRIPPER.COM Unique Desktop Strippers since 1998, 20+ Millions users, 3000+ Girls to choose from, All UHD Exclusive Content.

02-03-2004, 11:25 AM	#14
andi_germany Confirmed User Join Date: Oct 2002 Location: Germany Posts: 768	The security risk is that a user uses that feature and then visits another site from your members section. As referrer you will see the URl including the username and password. I used to surf a lot of porn for free that way ;) __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, then you may use a 624x80 instead of a 120x60.

02-03-2004, 06:57 AM	#2
arg Confirmed User Join Date: Feb 2003 Posts: 1,164	I used it just on my local home page, to log into sponsor sites and such. I figured "no big deal, I'll just use Stats Remote to log in to the sponsor sites," but unfortunately Stats Remote used the same technique.

02-03-2004, 07:08 AM	#4
Ash@phpFX Confirmed User Join Date: Nov 2003 Posts: 4,292	thats fucking stupid, why would they do that?

02-03-2004, 07:09 AM	#5
Trax [----------------------] Join Date: Aug 2001 Posts: 14,486	yeah i noticed statsremote use the same what will they do? is this a problem at all?

02-03-2004, 08:00 AM	#8
arg Confirmed User Join Date: Feb 2003 Posts: 1,164	The reason was that scammers would send people a URL like: http://www.visa.com:[email protected]/ and fucking nimrods would see "www.visa.com" and enter their credit card info. I can see why MS wants to cater to nimrods, but I wish they'd allowed non-nimrods to enable user:pw@ as an option.

02-03-2004, 09:47 AM	#13
Alex Xe Guest Posts: n/a	Not good news...

02-03-2004, 11:35 AM	#15
Rictor Old Timer Industry Role: Join Date: Jan 2001 Location: Indianapolis Posts: 12,208	I see a lot of username/passwords in my referrer logs too. People really shouldn't use that feature.

02-03-2004, 01:07 PM	#16
garce Confirmed User Industry Role: Join Date: Oct 2001 Location: Toronto Posts: 7,103	The update deleted all of my stored passwords, as well. I've spent half the day searching through old emails and printouts. garce