Wow! What a lame design. You tend to expect stuff like that from Ipswitch. I'm running 8.15hf2, and can only get the password to go into the cookie if I select the checkbox "Check here if this is your private computer and you want to use cookies to store your log-in information."
It doesn't do it otherwise. Session management is handled by another cookie field, myImailSessionKey/Number. However, cookies are deep within the user's profile, and any reasonable security plan will protect user profile data (this is not to say a reasonable security plan is particularly common<g>), but I do see your issue. If you disable the "Remember Me" checkbox (Hack the form), then this won't occur (at least on 8.15). You users will have to type their passwords (and if it's not HTTPS, send them over the wire in plain text). Dan -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sid Hatfield Sent: Thursday, July 21, 2005 3:25 PM To: [email protected] Subject: [IMail Forum] Need some help Hey guys, kinda new here and to Imail. We are running 8.13 and just discovered that on Mozilla and some none XP pcs that the users password is stored in a cookie in plain text. Is there a fix for this yet? Some of our users have discovered this and really freaking about it. I'm having problems finding much info on it. Can someone point me in the right direction? Thanks a lot. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
