Title: Message
|
Hi,
What we did was put a frame wrapper arround the
session. That way the id string is not visible on the screen. Of course the next
person is still able to "login" without logging in if the user simply closes the
browser in stead of loggin off, but it is harder to find *which* id is the
right one if that computer is being used a lot to access the IMail
server.
Groetjes,
Bonno Bloksma
----- Original Message -----
Sent: Wednesday, January 19, 2005 5:47
AM
Subject: Re: [IMail Forum] IMail 8.15
Security Issue !
In other words, there is no fix or workaround on
this issue..we just have to live with it..hmmmm..need to think of another
email solution already..
-Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005 12:19
PM
Subject: RE: [IMail Forum] IMail 8.15
Security Issue !
The problem when connecting through a service that proxies
connections is the users ip address can change during their session. Imail
handles this poorly. Where they should use a cookie to validate the session
against the url they don't, they rely on the ip address (checking) or no ip
address (no checking).
Connecting throught a proxy server makes no difference with checking
is turned off. If the url is known then the session can be hijacked proxy or
no proxy
Kevin
Dear Kevin,
Does this mean that the users that are
connecting to the same proxy server will still have the same issue where
they can go into other's email account with the URL ?
Rgrds,
Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005
11:29 AM
Subject: RE: [IMail Forum] IMail
8.15 Security Issue !
There is a setting in the web service called "ignore source
address in security check". Uncheck the box. Now with that said users
from ISPs that proxy their users will have difficulty staying
connected. When their ip address changes they will need to log in again.
This is a problem with useres that connect form AOL.
Kevin Bilbee
Hi,
I just found out that if I login to my
webmail, view one of the email or open a folder and copy the current
URL on the address bar and open the URL at other pc or terminal, I
will be able to view or go into my account without login
in.
This will work if my session is still
there or I'm still login in.
Any fix or solution for this
?
Thank you.
Rgrds,
Zul
|
