About RSS Topic & Post Feeds

Using the encrypted password in the querystring is also a a BIG security hole and not something I would want to use.

For security reasons the database encrypted passwords, security codes, etc. are updated periodically to add extra security to the system.

There is no permanent way to ID a user and any permanent solution through the use of querystrings and/or cookies would open a huge security hole in the software.

Cookies, querystrings, etc. are cached and can be got by hackers very easily, if a hacker gets hold of any permanent way of ID'ing a member they can use this to gain control of that users account.

Using the system you mention a hacker can very easily get hold of encrypted password, forum tracking codes, etc. then append this to an RSS Feed to view posts that they are not permitted to.

I have done allot of work in securing web wiz forums with white hat hackers and spent allot of time following security sites on hacking, and know that if such a system were implemented it would be only weeks, if not days, before hackers were announcing this as a big security hole in the software, and people demanding it be patched.


Edited by -boRg- - 16 June 2006 at 9:56am

I think alternate way for check RSS System.

I don't know your code, but to me just adding a 4 characters to a querystring will not take very long at all for a hacker to find an exploit in this and publish the results so that anyone can view posts they shouldn't do in forums.

If all you are doing is having 1 link for Guests and having a different link for Registered users then you have no security at all, all it needs is for someone to give out the link they shouldn't and anyone has access to posts they shouldn't.