Gabriel D Subba » White Label Social Networks http://www.kuzzuk.net A weblog of my personal and entrepreneurial journey Sat, 04 Feb 2012 23:56:02 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Security Loophole In Ning Social Networking App? http://www.kuzzuk.net/ning-social-network-security-loophole.html http://www.kuzzuk.net/ning-social-network-security-loophole.html#comments Wed, 08 Apr 2009 12:28:29 +0000 Kuzzuk http://www.kuzzuk.net/?p=128 Posted in Social Media

I’m not a security expert but there have been a number of cases within the social network for Darjeeling that I run (with over 1,000 members) using Ning where someone logs in as another person and wreaks havoc giving the administrators a hard time. One of our members dropped me a Facebook message informing me [...]]]> Posted in Social Media

ning social network app security threat

Image Source: sxc.hu

I’m not a security expert but there have been a number of cases within the social network for Darjeeling that I run (with over 1,000 members) using Ning where someone logs in as another person and wreaks havoc giving the administrators a hard time.

One of our members dropped me a Facebook message informing me of the security loophole telling me that Ning transmits email address and password in cleartext.

the site is transmitting userid and password in clear text. i know the login form with ning id is secure but there there a field named xg_token as “xg_token=&emailAddress=me@gmail.com&password=password” somewhere in the code that is doing this.

Like I said before, I’m not an online security expert but I downloaded a sniffer from Effetech to test the claim using my own email address and password in Ning. I could see my password in cleartext (masked in the screenshot below). Additionally, as a logical test I tried sniffing my own Gmail username and password which was unsuccessful. In my own layman way, this probably means that the Ning password is being sent in cleartext while Gmail sends it securely.

Password Sniffer For NingI have informed Ning and let’s see what they have to say about it. Meanwhile, has anyone had this issue with Ning before?

]]> http://www.kuzzuk.net/ning-social-network-security-loophole.html/feed 2