IPB cookies

Post by **pkk** » Sat Nov 07, 2009 9:00 pm

I hate logging in every time, after I visited this forum from a different computer.

Seems like it is a security function, because I only have this problem on this site (visiting no other IPBoard).

I have no idea if it can be turned off...

notjarvis · Post by **notjarvis** » Sat Nov 07, 2009 10:05 pm

pkk wrote:QUOTE (pkk @ Nov 7 2009, 09:00 PM) I hate logging in every time, after I visited this forum from a different computer.

Seems like it is a security function, because I only have this problem on this site (visiting no other IPBoard).

I have no idea if it can be turned off...

Thats strange cos I never have this problem.

I log in from multiple computers on a regular basis and I don't often need to relohgin....

Adam4 · Post by **Adam4** » Sun Nov 08, 2009 12:25 pm

notjarvis wrote:QUOTE (notjarvis @ Nov 7 2009, 10:05 PM) Thats strange cos I never have this problem.

I log in from multiple computers on a regular basis and I don't often need to relohgin....

madpeople · Post by **madpeople** » Sun Nov 08, 2009 3:05 pm

I have the logout problem. Further to that, logging in once on Computer B can mean that I need to login every time I visit on Computer A for a long time after.

FF 3.5.5 / 3.5.3

Post by **Tigereye** » Tue Nov 10, 2009 3:25 am

As pkk speculated, this is a security feature of IPB and is on by default.

I can disable it. Actually, come to think of it, considering our entire forum is in the clear (no SSL cert used) there's no real security gained by this setting...
If someone can sniff your sessionID, they can sniff your password while logging into the forum anyways.If someone wants to force you to log into your account, they can invalidate your session for you, forcing you to log in (so they can sniff your password in plaintext)If someone is at your computer copying your cookie from your harddrive, they can copy your browser passwords too using any number of local attacks.
I'll turn this off when I get home which should allow a session to persist regardless of IP.

I believe the result would be: you'll need to log in once from that machine and then your cookie will save your login session until you clear cookies on that machine. Logging in on another machine would duplicate the cookie there without invalidating the first machine's cookie.

If we ever enable SSL on our forum (which wouldn't add any value except for the ZLs and myself), I'll reconsider this setting, but for now it doesn't add any real security.

In the meantime:Community leaders (ZLs, SLs, etc): watch where you log into our forum. Script-kiddies love sniffing

Everyone: I recommend you use a different password for this forum than everything else (including ASGS).
--TE
(PS: for those of you who are suddenly worried, we've lived like this for the last 8-9 years so don't sweat it)

Post by **pkk** » Tue Nov 10, 2009 5:31 pm

Tigereye wrote:QUOTE (Tigereye @ Nov 10 2009, 04:25 AM) (PS: for those of you who are suddenly worried, we've lived like this for the last 8-9 years so don't sweat it)

Nope, we didn't. We live with that feature, since pook switched from phpnuke/phpbb to IPB in June 2006.

Seems like nobody else took care of it.

Post by **Tigereye** » Wed Nov 11, 2009 10:59 pm

Neither of the PHPnuke or phpbb forums were protected with an SSL certificate, so we've had unencrypted forums for the last 8-9 years. I don't even think the Microsoft Gaming Zone had a cert back when Allegiance was on it

--TE

Dorjan · Post by **Dorjan** » Fri Nov 13, 2009 2:21 pm

I just assumed this was the security feature by IP so never complained. It'll save me from having to log in everyday at home / work.

Thanks TE / pkk

Cadillac · Post by **Cadillac** » Fri Nov 20, 2009 5:04 pm

Can you delete this thread now, I've been tormented enough.

Post by **pkk** » Fri Nov 20, 2009 5:18 pm

Cookie Monster wrote:QUOTE (Cookie Monster @ Nov 20 2009, 06:04 PM) Can you delete this thread now, I've been tormented enough.

Nope, someone turned that setting back on...