Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Onion Service Using GET for Password Instead of POST #73

Closed
The2b opened this issue Dec 23, 2017 · 2 comments
Closed

Onion Service Using GET for Password Instead of POST #73

The2b opened this issue Dec 23, 2017 · 2 comments
Labels
enhancement high-priority

Comments

@The2b
Copy link

The2b commented Dec 23, 2017

The default service created by Haven and Orbot, when using a password, uses GET to send the password, rather than POST. This exposes the password to the hidden service to anyone who can see the accessing device's URL bar.
@itsN1X
Copy link

itsN1X commented Dec 24, 2017

encr. passw.?

@The2b
Copy link
Author

The2b commented Dec 24, 2017

@itsN1X Cleartext

@essandess essandess mentioned this issue Dec 25, 2017
Open
@mig5 mig5 mentioned this issue Dec 30, 2017
Merged
@n8fr8 n8fr8 closed this as completed in #168 Jan 2, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement high-priority
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@n8fr8 @The2b @itsN1X