Title: Message
|
Yup,
just waiting for declude to comeout of beta for SmarterMail and we are jumping
ship.
Kevin
In other words, there is no fix or workaround on
this issue..we just have to live with it..hmmmm..need to think of another
email solution already..
-Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005 12:19
PM
Subject: RE: [IMail Forum] IMail 8.15
Security Issue !
The problem when connecting through a service that proxies
connections is the users ip address can change during their session. Imail
handles this poorly. Where they should use a cookie to validate the session
against the url they don't, they rely on the ip address (checking) or no ip
address (no checking).
Connecting throught a proxy server makes no difference with checking
is turned off. If the url is known then the session can be hijacked proxy or
no proxy
Kevin
Dear Kevin,
Does this mean that the users that are
connecting to the same proxy server will still have the same issue where
they can go into other's email account with the URL ?
Rgrds,
Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005
11:29 AM
Subject: RE: [IMail Forum] IMail
8.15 Security Issue !
There is a setting in the web service called "ignore source
address in security check". Uncheck the box. Now with that said users
from ISPs that proxy their users will have difficulty staying
connected. When their ip address changes they will need to log in again.
This is a problem with useres that connect form AOL.
Kevin Bilbee
Hi,
I just found out that if I login to my
webmail, view one of the email or open a folder and copy the current
URL on the address bar and open the URL at other pc or terminal, I
will be able to view or go into my account without login
in.
This will work if my session is still
there or I'm still login in.
Any fix or solution for this
?
Thank you.
Rgrds,
Zul
|
