Potential security issue when logging in to the forum

So, I’ve noticed this weird thing happening a few times now when I try to sign in to the forum. Usually, the first attempt just fails, and then it works perfectly on the second try.

Since the login is going through plain HTTP, you guys might be sitting ducks for a man-in-the-middle attack. Seriously, it's a bit sketchy.

I just had this happen tonight, Monday the 8th, right around 11:55 PM, so feel free to dig through the logs and check out those failed attempts.

☕

That happens to me every now and then too.. 🤷

Anyway, I’m logging back in now.. 😁

And what exactly would a man-in-the-middle attack even look like here? 🍿

ambermason16 said:So, what exactly does a man-in-the-middle attack look like?

It’s basically how they snag your password.
Imagine there's this fake website designed to look exactly like a legitimate forum. You go there, you enter your login info thinking everything is fine, and then they redirect you to the actual site. But here's the catch: while you were being "redirected," they already logged your credentials on their end.

Personally, I don't think that's what happened in this case.

Sam Green73 said:How they snatch passwords.
They set up a fake site that looks just like a forum, you log in, they redirect you to the actual forum, but they’ve already logged your password in the background.

I doubt that's what happened here.

Good grief! My millions are at risk because my forum password isn't secure enough!!! I demand an immediate explanation and full compensation from the admins, the owners of unknown, the President, and the CEO of the entire Internet! 😁

Jack Cook7 said:I've noticed a few times now that when I try to log into Reddit, it doesn't work on the first try. Usually, it goes through on the second attempt....

I think there was already a thread about this somewhere, but I can't remember what the consensus was.

As for me, I can't even get logged in; usually, when it fails, I have to try about 5, 6, 7, or 8 times before it finally sticks.

Sam Green73 said:How passwords are collected.
There's this site.....

Wait, why isn't this using the HTTPS protocol???

ambermason16 said:Good grief! My millions are in serious danger because of this forum password!!! I demand an explanation and compensation from the admins, the owner of unknown, the President, and the Director of the Internet! 😁

Typical off-topic rambling, as usual.

Sandra Parker3 said:nah... I can't even get logged in, and usually when it doesn't work right away, it takes like five, six, seven, eight tries before it finally sticks

The same thing happens to me whenever I'm at the office. Even after I log out and clear my cookies and all that other junk, I'll come back the next day and find myself already logged into Reddit without doing anything... 😕

And no, I don't have CCleaner or any of those tools—I'm not allowed to download random apps on my work machine. 🙂

Sam Green73 said:The method they use to harvest passwords.
They set up a fake landing page that looks just like a legitimate forum. You think you're logging in, but once you hit submit, they redirect you to the actual site while simultaneously logging your credentials on their end.
...

... something like that?

example-site.com/index.php?

casualharbor9 said:... something like that?

example-server.com/index.php?

I'm assuming "lb" is just shorthand for load balancing.

yup

Is this lb.orbis.hr link glitching out at the exact same time as Reddit? 🤔

Sandra Parker3 said:And why isn't it using the HTTPS protocol???

Because there’s honestly zero need for it—we aren't running any credit card transactions or handling sensitive data here... and since SSL certificates actually cost money, unless you're looking to pay a premium just to browse the forum, we'll stick to this. 🙂

Sandra Parker3 said:Just stay on topic here, following the usual rules...

Oh, give me a break with the drama... seriously, who actually gives a damn about your password, my password, or anyone else's? You act like some massive terrorist organization is going to launch a high-tech cyberattack just to figure out if you’re logging into Reddit as "butterfly1" or "butterfly2." It's ridiculous. ☕

It's just a glitch... nothing more, nothing less.

Man, everyone's stressing about MITM attacks, but they're running vBulletin 384. I’d bet my bottom dollar an xss exploit would slide right through without anyone even noticing.

Benjamin King2 said:...SSL certs aren't free, so do you want to start paying just to access the forum? 🙂

Why on earth would I pay for forum access? 🤷

I don't even pay Google for Gmail.