1

I just tried to reset my password on radioooooo.com.

I didn't really pay attention to firefox's warnings because I'm used to see them on our intranet at work, but I think that when clicking the "OK" button my password might have been transmitted in clear.

Here is what I did:

  • Asked for a password reset
  • Received a link by email to reset my password, that looks like this: http://radiooooo.com/#reset/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
  • Entered a new password
  • Clicked OK, which seemed to have sent an OPTION and a POST to http urls

Here are the requests:

OPTIONS XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 200 OK 299ms]
POST XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 404 Not Found 514ms]

I'm not familiar with Firefox's console but the POST does not seem to have a body, which makes me think my password was not actually sent. Here is the header:

Accept*/*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Connection keep-alive
Content-Length 71
Content-Type application/json
DNT 1
Host admin1.radiooooo.com
Origin http://radiooooo.com
Referer http://radiooooo.com/User-AgentMozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0

And the response's header:

Cache-Control no-cache, no-store, max-age=0, must-revalidate
Connection keep-alive
Content-Encoding gzip
Content-Type application/json;charset=UTF-8
Date Thu, 22 Mar 2018 19:22:36 GMT
Expires 0
Pragma no-cache
Servernginx/1.2.1
Transfer-Encoding chunked
Vary Accept-Encoding
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-XSS-Protection1; mode=block

2 Answers 2

4

Yup, the password was sent. You can tell from the content length header that the body was not empty.

Firefox shows the POST data in a separate tab when you select the request.

2
  • For some reason nothing happens when I click the POST in the console. Commented Mar 22, 2018 at 20:00
  • Well I see the payload in chrome's console. The password is transmitted indeed... Commented Mar 22, 2018 at 20:06
1

While your password was reset, as per @GeirEmblemsvag post above, you should reset it via HTTPS. As you may know, resetting (or ever transmitting) a password makes it available to eavesdropping. It's safest to just navigate to that site over HTTPS and reset the password again.

2
  • The site is not even reachable from HTTPS... Commented Mar 22, 2018 at 19:59
  • Well, you're as secure as you're gonna get then! Hope you don't use that password elsewhere. Commented Mar 22, 2018 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .