1

I just tried to reset my password on radioooooo.com.

I didn't really pay attention to firefox's warnings because I'm used to see them on our intranet at work, but I think that when clicking the "OK" button my password might have been transmitted in clear.

Here is what I did:

  • Asked for a password reset
  • Received a link by email to reset my password, that looks like this: http://radiooooo.com/#reset/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
  • Entered a new password
  • Clicked OK, which seemed to have sent an OPTION and a POST to http urls

Here are the requests:

OPTIONS XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 200 OK 299ms]
POST XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 404 Not Found 514ms]

I'm not familiar with Firefox's console but the POST does not seem to have a body, which makes me think my password was not actually sent. Here is the header:

Accept*/*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Connection keep-alive
Content-Length 71
Content-Type application/json
DNT 1
Host admin1.radiooooo.com
Origin http://radiooooo.com
Referer http://radiooooo.com/User-AgentMozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0

And the response's header:

Cache-Control no-cache, no-store, max-age=0, must-revalidate
Connection keep-alive
Content-Encoding gzip
Content-Type application/json;charset=UTF-8
Date Thu, 22 Mar 2018 19:22:36 GMT
Expires 0
Pragma no-cache
Servernginx/1.2.1
Transfer-Encoding chunked
Vary Accept-Encoding
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-XSS-Protection1; mode=block
4

Yup, the password was sent. You can tell from the content length header that the body was not empty.

Firefox shows the POST data in a separate tab when you select the request.

| improve this answer | |
  • For some reason nothing happens when I click the POST in the console. – little-dude Mar 22 '18 at 20:00
  • Well I see the payload in chrome's console. The password is transmitted indeed... – little-dude Mar 22 '18 at 20:06
1

While your password was reset, as per @GeirEmblemsvag post above, you should reset it via HTTPS. As you may know, resetting (or ever transmitting) a password makes it available to eavesdropping. It's safest to just navigate to that site over HTTPS and reset the password again.

| improve this answer | |
  • The site is not even reachable from HTTPS... – little-dude Mar 22 '18 at 19:59
  • Well, you're as secure as you're gonna get then! Hope you don't use that password elsewhere. – Monica Apologists Get Out Mar 22 '18 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.