company is sending md5 string via GET['password'] dangerous?

Question

So, this big, reknown company (you all heard off) is sending md5 encrypted strings (with GET key: password) over HTTP.

I accidentally came over it since I wanted to use jnlp on a non-windows machine. And I am curious. Is it by definition insecure to work like this, or can it be safe when one uses SALT and other stuff alike?

The URL looks like this: url/folder/page/?login=[USERNAME]&password=[MD5-String] This URL is also stored in the corresponding .jnlp file.

I hashed my password to MD5 and it is not the same as the password in the URL.

First and foremost, I am curious. I do not have the skills to exploit this (if it where possible), and don't even want to exploit it. If you guys think I should notify the company in question: I will do so.

Thanks!

Answer 1

I am curious. Is it by definition insecure to work like this.

No. Submitting passwords via GET is not fundamentally less secure than submitting them via POST (which is what every other site does). It does mean that the "password" is stored unencrypted, but if done right, that password that they're storing not your actual login password but rather a password used specifically for this purpose. In fact, the string you see that you assume is MD5 may actually be the password itself, generated at random.

A authentication token passed in a URL is problematic because it (a) is easy to copy, even accidentally, (b) is cached, (c) shows up in referrer strings, (d) shows up in logs, (e) offers little in the way of actual authentication. Instead, of doing true authentication, the URL itself is the key.

On the other hand, this may be exactly what the company wants. If you want a protected resource to be accessible to anyone who knows the correct URL, then this is how you do it.

If they simply called it "access token" instead of "password", would you suddenly feel better about it?

If you guys think I should notify the company in question: I will do so.

If that will make you feel better, then go ahead and tell them. They already know, of course, since they built it. It'd be like notifying someone that their car is blue.