Gammae/Fame Dollars showing me my password over http - GoFuckYourself.com

Arnox · 07-23-2018, 11:36 PM

It's 2018, please - can affiliate programs start to tighten up their security? Why do you have my plaintext password stored anywhere? Why can I not access your website via https?

Crazy.

Arnox · 07-23-2018, 11:39 PM

And I just realized they truncated my password to 16 characters... =/

JPN · 07-24-2018, 12:00 AM

If you saw your password right after you signed up, it doesn't mean your password isn't hashed and stored.
Maybe be just showing $_POST data.

k0nr4d · 07-24-2018, 01:27 AM

Try the forgot password function. If your password is emailed to you it's stored plaintext. If it's reset to something else it suggests they most likely are only storing a hash.

BigFurry · 07-24-2018, 01:33 AM

When I tried last time, the old pass was emailed with "forgot password". And it was truncated.

So the OP is right I believe :-(

- they store plaintext passes
- truncate them, not allowing proper password strength
- use plain HTTP, no encryption

Arnox · 07-24-2018, 07:22 AM

Quote:

Originally Posted by JPN

If you saw your password right after you signed up, it doesn't mean your password isn't hashed and stored.
Maybe be just showing $_POST data.

It was emailed to me as well, but even if it's hashed and stored, it's being served over http. I don't like that.

It's not like I reuse passwords, but lax security here suggests lax security elsewhere.

derrick1 · 07-26-2018, 01:07 PM

Thanks for pointing out the issues that we have with the cash program. While we have already moved our paysites over to an https model, we are currently in the process of finding a solution to improve the security and user-experience of our cash programs as well.

As soon as we launch improvements, we will make sure to let our affiliates know

Bladewire · 07-30-2018, 03:14 AM

Bump for business

07-23-2018, 11:36 PM	#1
Arnox Confirmed User Industry Role: Join Date: Sep 2009 Location: Radelaide Posts: 2,160	Gammae/Fame Dollars showing me my password over http It's 2018, please - can affiliate programs start to tighten up their security? Why do you have my plaintext password stored anywhere? Why can I not access your website via https? Crazy. __________________ Need Text? X Copywriters \| Adult Writing Service - [email protected]

07-23-2018, 11:39 PM	#2
Arnox Confirmed User Industry Role: Join Date: Sep 2009 Location: Radelaide Posts: 2,160	And I just realized they truncated my password to 16 characters... =/ __________________ Need Text? X Copywriters \| Adult Writing Service - [email protected]

07-24-2018, 01:27 AM	#4
k0nr4d Confirmed User Industry Role: Join Date: Aug 2006 Location: Poland Posts: 9,228	Try the forgot password function. If your password is emailed to you it's stored plaintext. If it's reset to something else it suggests they most likely are only storing a hash. __________________ Mechanical Bunny Media Mechbunny Tube Script \| Mechbunny Webcam Aggregator Script \| Custom Web Development

07-26-2018, 01:07 PM	#7
derrick1 Confirmed User Join Date: Nov 2008 Posts: 480	Thanks for pointing out the issues that we have with the cash program. While we have already moved our paysites over to an https model, we are currently in the process of finding a solution to improve the security and user-experience of our cash programs as well. As soon as we launch improvements, we will make sure to let our affiliates know __________________ Derrick Sales Manager FameDollars [email protected] Skype: derrickfamedollars

07-30-2018, 03:14 AM	#8
Bladewire StraightBro Industry Role: Join Date: Aug 2003 Location: Monarch Beach, CA USA Posts: 56,232	Bump for business __________________ Skype: CallTomNow

07-24-2018, 12:00 AM	#3
JPN Confirmed User Industry Role: Join Date: Oct 2011 Location: The land of the rising sun Posts: 58	If you saw your password right after you signed up, it doesn't mean your password isn't hashed and stored. Maybe be just showing $_POST data.

07-24-2018, 01:33 AM	#5
BigFurry Confirmed User Industry Role: Join Date: Nov 2003 Posts: 1,554	When I tried last time, the old pass was emailed with "forgot password". And it was truncated. So the OP is right I believe :-( - they store plaintext passes - truncate them, not allowing proper password strength - use plain HTTP, no encryption