As of recently this security hole has been silently fixed.
________________________________ From: Peter Lustlos <[email protected]> To: [email protected] Sent: Monday, December 10, 2012 2:57 PM Subject: Any.Do sends passwords in plaintext Any.Do transmits Passwords in plaintext. == Some of you may be interested to know that the Task Management and TODO-list Application, Any.Do, happily transmits your password and just about everything else in plaintext. They were even so kind to include a README.md documenting exactly this "feature": >>> Login >>> ----- >>> >>> * Right now, the only form encoding call done to the server is the login >>> process. >>> * Only POST is supported. >>> * The parameter *_spring_security_remember_me* should always be specified. >>> * Password is not encoded/encrypted in the request. >>> >>> Endpoint: /state-manager/j_spring_security_check >>> >>> POST parameters: >>> >>> { >>> j_username: <email>, >>> j_password: <password>, >>> _spring_security_remember_me: "on" >>> } Just to verify this is actually happening I made use of wireshark: http://imm.io/ODou
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
