cookies / ideastation session lifetimes

[roambotics_scott]

In addition to the chronic SSL problem with the forum forcing everyone to send their passwords in plaintext (which nobody seems to care about despite it being super janky and a totally unnecessary / preventable security risk for anyone who reuses passwords), I keep getting logged out of IdeaStation despite hitting «stay connected».

Not sure this is the problem but the forum is setting a cookie «LiSESSIONID» with a lifetime of «Session».

That sounds great but «Session» just means «until the user closes the browser» which I suspect is why I'm having to re-login all the time.

It'd be great to fix both of these issues (note that not being able to stay signed in indefinitely means that people are probably logging in often and every time they do that there is a new chance for any minimally competent script kiddy to see their password.

For anyone who doesn't understand what I'm talking about - you shouldn't have to, but suffice it to say that it's really, really bad in terms of web security and one of the most basic things that a competent web developer should know about and take care of.

[brianrepp]

@roambotics_scott Re: the timeout, were you seeing this regularly prior to the maintenance work on the forums Saturday?  The update made a change where it's timing users out at 30mins if they havent been active on the forums.  I'm hoping for a fix within the next day or two.

[roambotics_scott]

The timeout is definitely new, @brianrepp. The SSL thing seems to be a regression (though I'm not sure when that started back up again)

[kb9ydn]

Every time I login I get this message:

This has been going on as long as I can remember (at least a year) and the only time I didn't get it was for a brief period where I tried using Opera for a browser instead of Firefox.

The timeout thing I haven't really noticed.

C|

[roambotics_scott]

Yeah the timeout is driving me nuts but that message is not a joke.

Presumably people use the same information here as for their F360 account which means that anything stored there is easily accessable to anyone who bothers packet sniffing someone logging in here. That's a major security risk and pokes a major hole in the «cloud rather than local storage is perfectly safe» message that AD wants / needs to push.

What's maddening to me is that it really shouldn't be complicated to fix and that it hasn't been touched in forever screams that AD doesn't take it seriously and/or that their web people aren't minimally competent.

[brianrepp]

The timeout is also driving me crazy :-), and it is still being investigated.

Re: the security concerns, a project is coming up shortly to make an upate on the Fusion forums to fix.

[psi_veit]

Quick update on the timeout: Our vendor is acknowledging this issue and is currently investigating.  Please be patient for a little while longer.

-veit

[brianrepp]

@roambotics_scott Wanted to check-in and see if you're still experiencing any of these issues?

[roambotics_scott]

Haven't noticed them in awhile. Thanks, @brianrepp !