BHW, let's DEMAND Cleanfiles protects our passwords!!!

[Fryyy]

I sadly just today noticed that Cleanfiles never bothered to buy an SSL certificate to secure our information.
It costs what, 30-100 dollars depending on where you buy???

Also, When you log-in at cleanfiles.net/login, it redirects you to cleanfiles.net/login?username=USERNAME&password=PASSWORD
PLAIN TEXT.

This is poor programming.
I'm sorry to whom owns CF. I use your network and I love it but, knowing my login details are so poorly communicated that any monkey that can pull up my history has my password ....

Why not send the username and password via POST instead of GET?
Furthermore, please purchase SSL.

If you cannot purchase SSL I will custom code you a jQuery password obfuscation algorithm so at least if I leave my computer or phone somewhere by mistake someone cannot pull up my password by looking at my history. That would still be shoddy security however.

Also if you're not into coding and would supply me with a copy of what I assume is login.php, I will recode it and send it back to you so that it uses POST instead of the query string.

To BHW members that use CF, please help to push securing our information.
You wouldn't want your hard earned PPD money stolen by some script-kiddy with a packet sniffer.

 

[SocialMediaManager]

Read all those CL Password hacked threads

 

[lancis]

Why should they purchase a SSL certificate?

Its much more logical to demand that they use SSL with self signed certificate. Then demand from major browsers to remove that ugly warning message that you get when your certificate is self signed.

 

[keytenx]

tell that to this guy:

http://www.blackhatworld.com/blackhat-seo/members/149940-hellohellosharp.html

and start a thread about it on their forum .

 

[royserpa]

OP, you said exactly the stuff I first noticed when joining CF.

That's what has been keeping me away from CF

 

[Fryyy]

You have a point, to an extent.
They would never remove them though.
If I thought they would, I wouldn't bother purchasing SSL myself, I'd self-sign instead but sadly it is what it is.

Why should they purchase a SSL certificate?

Its much more logical to demand that they use SSL with self signed certificate. Then demand from major browsers to remove that ugly warning message that you get when your certificate is self signed.

 

[gaabrielz]

I have to agree,

This is poor programming.

 

[bartosimpsonio]

Why should they purchase a SSL certificate?

Its much more logical to demand that they use SSL with self signed certificate. Then demand from major browsers to remove that ugly warning message that you get when your certificate is self signed.

This is a great comment. I don't trust a godaddy seal any more than I trust jon doe. The only purpose to SSL is to encrypt your traffic, those identities given in certificates are about as trustworthy as facebook profiles.

 

[Sombees]

I guess not much you can do now except make sure you know who uses your computer..

 

[powerman123]

I did not know cleanfiles wasnt secure