Offers Received Page

olebean · 29-08-2007, 07:32 PM

PM sent to Sedo!

rjs_essex · 29-08-2007, 09:12 PM

This has always been a serious security flaw with Sedo's login system. It creates session urls that don't expire from one user / machine to another... Hence why you should never put sedo links anywhere on the net that include your session data within the url!

Lee - I have edited your original post for you - I hope anyone reading this thread (even guests) have not done anything untoward - Double check your account settings etc!

Rich

olebean · 29-08-2007, 09:24 PM

Quote:

Originally Posted by rjs_essex

This has always been a serious security flaw with Sedo's login system. It creates session urls that don't expire from one user / machine to another... Hence why you should never put sedo links anywhere on the net that include your session data within the url!

Lee - I have edited your original post for you - I hope anyone reading this thread (even guests) have not done anything untoward - Double check your account settings etc!

Rich

And change passwords!!

rjs_essex · 29-08-2007, 09:52 PM

Quote:

Originally Posted by olebean

And change passwords!!

Always a good idea but at Sedo you can't see you current password and you have to enter your old password to create a new one so no one could have changed it and even if they did you would be unable to log back in...

sedo · 30-08-2007, 08:11 AM

Hi Everybody,

Thank you all for this, I'll get our tech-people on this straight away.

Shaun

sedo · 30-08-2007, 10:18 AM

Hello All,

A message from Sedo's technical department, although one I'm sure most of you are aware of this - never post links containing session ID's!! It is written in our terms and conditions, and also in our FAQ's, that this should never be done. Our techies are currently working on a solution to this, hopefully making it impossible to get into accounts this way even if the links are posted.

However, please take care with this!

Regards,

Shaun

shaun.wilkinson@sedo.com

rjs_essex · 30-08-2007, 11:56 AM

Quote:

Originally Posted by sedo

Hello All,

A message from Sedo's technical department, although one I'm sure most of you are aware of this - never post links containing session ID's!! It is written in our terms and conditions, and also in our FAQ's, that this should never be done. Our techies are currently working on a solution to this, hopefully making it impossible to get into accounts this way even if the links are posted.

However, please take care with this!

Regards,

Shaun

shaun.wilkinson@sedo.com

How long have they been working on this? It's been the same since I can remember...

Sedo is the only major site that I know of that has this problem... its very lax security in my opinion...

sedo · 30-08-2007, 03:12 PM

My colleague in the tech department that system updates to resolve this problem should be up and running within a couple of weeks.

Regards,

Shaun

shaun.wilkinson@sedo.com

aquanuke · 30-08-2007, 03:32 PM

Quote:

Originally Posted by sedo

My colleague in the tech department that system updates to resolve this problem should be up and running within a couple of weeks.

Regards,

Shaun

shaun.wilkinson@sedo.com

How's this for security

Couple of weeks, Almost a year since last time someone mentioned this problem.

LeeOwen · 31-08-2007, 03:47 AM

Quote:

Originally Posted by sedo

Hello All,

A message from Sedo's technical department, although one I'm sure most of you are aware of this - never post links containing session ID's!! It is written in our terms and conditions, and also in our FAQ's, that this should never be done. Our techies are currently working on a solution to this, hopefully making it impossible to get into accounts this way even if the links are posted.

However, please take care with this!

Regards,

Shaun

shaun.wilkinson@sedo.com

so sue me, take care of your own security.

29-08-2007, 09:12 PM	#22
rjs_essex Join Date: Oct 2006 Location: Essex Posts: 1,450 No Classified Ratings Domain Trader Rating: (100% / 9)	This has always been a serious security flaw with Sedo's login system. It creates session urls that don't expire from one user / machine to another... Hence why you should never put sedo links anywhere on the net that include your session data within the url! Lee - I have edited your original post for you - I hope anyone reading this thread (even guests) have not done anything untoward - Double check your account settings etc! Rich __________________ Richard \| Atomic Edge \| Phone Insurance

30-08-2007, 08:11 AM	#25
sedo Sedo Staff Join Date: Aug 2005 Location: High Holborn, London, UK Posts: 722 No Classified Ratings Domain Trader Rating: (0% / 0)	Hi Everybody, Thank you all for this, I'll get our tech-people on this straight away. Shaun __________________ http://www.sedo.co.uk contact@sedo.co.uk

30-08-2007, 10:18 AM	#26
sedo Sedo Staff Join Date: Aug 2005 Location: High Holborn, London, UK Posts: 722 No Classified Ratings Domain Trader Rating: (0% / 0)	Hello All, A message from Sedo's technical department, although one I'm sure most of you are aware of this - never post links containing session ID's!! It is written in our terms and conditions, and also in our FAQ's, that this should never be done. Our techies are currently working on a solution to this, hopefully making it impossible to get into accounts this way even if the links are posted. However, please take care with this! Regards, Shaun shaun.wilkinson@sedo.com __________________ http://www.sedo.co.uk contact@sedo.co.uk

30-08-2007, 03:12 PM	#28
sedo Sedo Staff Join Date: Aug 2005 Location: High Holborn, London, UK Posts: 722 No Classified Ratings Domain Trader Rating: (0% / 0)	My colleague in the tech department that system updates to resolve this problem should be up and running within a couple of weeks. Regards, Shaun shaun.wilkinson@sedo.com __________________ http://www.sedo.co.uk contact@sedo.co.uk

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

29-08-2007, 07:32 PM	#21
olebean Join Date: Nov 2005 Location: Rarotonga Posts: 2,252 No Classified Ratings Domain Trader Rating: (100% / 1)	PM sent to Sedo!

Similar Threads
Thread	Thread Starter	Domain Name Community	Replies	Last Post
2/3/4 page site required to be made!	lex007	Website Design	1	26-09-2006 04:13 PM
Taking Offers	LeeOwen	Top Level Domain Names For Sale	0	20-09-2006 12:18 PM
Under £100	Meltdown	Archive UK Domains For Sale	1	02-05-2006 10:58 PM
Link to a certain section of a page? How to?	BFTUK	Website Design	2	14-02-2006 01:33 PM