sponsor stats leaking your USERNAME and PASSWORD to other sites
 

I'm becoming increasingly concerned at how some sponsors authenticate their stats - with the user and pass in the URL.

For example...

https://stats.globill-systems.com/cgi-bin/stats.cgi?partnerid=xxxxxx&password=xxxxxx
http://wm.mtree.com/wm.cgi/stats?mtaseqid=xxxxxx&mtapasswd=xxxxxx

There's too much chance for a referer 'leak', either with a direct link (globill's stats link directly to external sites - my u/p will show up in their referer logs if I click on those links), or with MSIE's buggy sending of referer lines from two or three pages back. With the latter scenario, ANY site you load could end up with your sponsor's u/p in their referer logs.

Non https:// URLs may get logged by any proxies you're using too. Anyone with access at optus@home (my ISP) can clearly see my moneytree ID and password in their proxy logs. Here's an example from my local caching proxy:

<font size=1>1050032864.223 7761 xxxxxx.xxxxxx.com TCP_MISS/200 67721 GET http://wm.mtree.com/wm.cgi/stats?<font color="#ff0000">mtaseqid=xxxxxx&mtapasswd=xxxxxx</font> - DIRECT/wm.mtree.com text/html</font>

This entry is sitting in a log file on my home unix gateway.

Am I the only one worried about this? :helpme

this whole industry, including the stats, are setup by a bunch of
bedroom idiots.

What do you expect?

How about packet sniffers? Even if you use the login box that pops up, your username and password is sent plain text....

Yeah, kinda scary.

If you're really concerned, don't click the links, copy them and paste them into your browser. That or you could make a custom login page that uses POST instead of GET. I'm sure it'd work if the scripts are using standard CGI libraries.

Agreed, but that's actively seeking out the details. This particular issue involves passive/accidental discovery of the u/p. :)

cluck: I don't click on the links, except for last night. I clicked on one of my affiliate IDs as I thought that would take me to stats for that account... it actually loaded up the paysite. They now have my u/p in their referer logs.

thats what happens when you hire 12 yr old programmers

I think If someone stole your account, You have all the time you need to contact your sponsor before he got your money! specially if he stole your WSB account :1orglaugh

This is why you need to check your stats at least a hundred times per day... for EACH sponsor. :Graucho

Ah, I knew there was a reason I did that! :)