+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [News] Security and Persistent Cookies (/showthread.php?tid=4747565)
Security and Persistent Cookies - Omniscient - Mar 25, 2015
This is something that has always bothered me when it comes to security and MyBB.
Let's say you have 2 or even 3 devices logged into HF. And on one device you logout. The cookies on the other devices will remain logged in. Yes, that's convenient but it's also a partial security risk. When I log out I expect all sessions to delete.
So in an effort to increase security, even if just a tiny bit, from now on when you click the logout link all sessions will be destroyed and all devices will require a login.
That's not to say you can only be logged into one device at a time. You can login to 10 devices if you want but just one logout and they will all need to login again.
Hope this helps. Enjoy and thanks.
* - Douchebag # 145 - Mar 25, 2015
THANK YOU THANK YOU THANK YOU THANK YOU.
This is actually something I really appreciate.
* - Juice WRLD - Mar 25, 2015
I thought it was already like that, either way this should help as you aforementioned. Thanks.
* - Freerunning - Mar 25, 2015
Thanks for this update Omni more power to HF!
* - Omniscient - Mar 25, 2015
(Mar 25, 2015 08:25 PM)Jabari Parker Wrote: I thought it was already like that, either way this should help as you aforementioned. Thanks.
Actually it wasn't and that's the fault of MyBB. The only way to destroy all session cookies was a password or email change. And that's just ridiculous.
* - 240sx - Mar 25, 2015
Smart idea, thanks for the security update Omni.
* - bandors - Mar 25, 2015
10/10 I thank you for this update, I don't have to be worried as much now :)
* - Viral Dragon - Mar 25, 2015
o.o Oh man, this might be troublesome for some, kind of like me when I log on
with a phone sometimes, or from a different computer like Icey's. Lol.
Overall though, any sort of security upgrade is better than none.
-Viral.
* - Envy - Mar 25, 2015
This is a really good update, I was wondering about it the other day that if I logged in somewhere and forgot to log out I wouldn't be able to do anything straight away.
* - cυвε - Mar 25, 2015
Thank you for the security and cookies update. Don't have to bother logging out from devices one by one now.
* - Juice WRLD - Mar 25, 2015
(Mar 25, 2015 08:32 PM)Viral Dragon Wrote: o.o Oh man, this might be troublesome for some, kind of like me when I log on
with a phone sometimes, or from a different computer like Icey's. Lol.
Overall though, any sort of security upgrade is better than none.
-Viral.
Not really troublesome, just a hassle to have to login every time? More security trumps over the few extra seconds it takes to re-login tho.
* - ℳanny - Mar 25, 2015
Wow thanks! Sometimes I would login on my moms phone / sisters phone when mine died and I always forgot to log out afterwards lol.
* - Mr.Peanut - Mar 25, 2015
Perfect, I could count all the times I've had friends/family go on my HF account for a few seconds (figuring what they're on) before closing out of it (on their device).
* - Gяαη∂тнεfтнσяsε - Mar 25, 2015
(Mar 25, 2015 08:27 PM)Omniscient Wrote: Actually it wasn't and that's the fault of MyBB. The only way to destroy all session cookies was a password or email change. And that's just ridiculous.
I reset my password a lot anyway so that's no big deal for me.
This could actually help out a lot in the face of a security compromise. (took me four tries to spell that right) If you know someone is in your account, log out and change password. Thanks a lot, Omni. You're the best <3
* - Juice WRLD - Mar 25, 2015
(Mar 25, 2015 08:57 PM)Gяαη∂тнεfтнσяsε Wrote: I reset my password a lot anyway so that's no big deal for me.
This could actually help out a lot in the face of a security compromise. (took me four tries to spell that right) If you know someone is in your account, log out and change password. Thanks a lot, Omni. You're the best <3
But couldn't that work vice versa? They could log you out and do the same thing?