Title: Message
|
In other words, there is no fix or workaround on
this issue..we just have to live with it..hmmmm..need to think of another
email solution already..
-Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005 12:19
PM
Subject: RE: [IMail Forum] IMail 8.15
Security Issue !
The
problem when connecting through a service that proxies connections is the
users ip address can change during their session. Imail handles this poorly.
Where they should use a cookie to validate the session against the url they
don't, they rely on the ip address (checking) or no ip address (no
checking).
Connecting throught a proxy server makes no difference with checking is
turned off. If the url is known then the session can be hijacked proxy or no
proxy
Kevin
Dear Kevin,
Does this mean that the users that are
connecting to the same proxy server will still have the same issue where
they can go into other's email account with the URL ?
Rgrds,
Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005
11:29 AM
Subject: RE: [IMail Forum] IMail 8.15
Security Issue !
There is a setting in the web service called "ignore source address
in security check". Uncheck the box. Now with that said users
from ISPs that proxy their users will have difficulty staying
connected. When their ip address changes they will need to log in again.
This is a problem with useres that connect form AOL.
Kevin Bilbee
Hi,
I just found out that if I login to my
webmail, view one of the email or open a folder and copy the current URL
on the address bar and open the URL at other pc or terminal, I will be
able to view or go into my account without login in.
This will work if my session is still there
or I'm still login in.
Any fix or solution for this ?
Thank you.
Rgrds,
Zul
|
