HIDDEN

The following post may have been a test post, a duplicate, or could have been hidden if it violated this site's Points of Unity. If you think this item should not have been hidden, first make sure it wasn't posted twice and you were just unable to find the other copy of the post. If that was not the case, you can contact the editorial collective by e-mailing indybay@lists.riseup.net.

Riseup Failing To Close Security Loophole

by eLBe Sat, Sep 29, 2018 12:49PM

Riseup Management is currently failing to close a security loophole enabling an attacker to manipulate Riseup user´s emails while they are being composed. The problem is concerning the multiple login feature, which does not only allows users to pursue more than one login at the same time, for whatever purpose this may be useful, but also enables a certain type of attacker to interfere with email composition in ways which do not immediately stand out as third party abuse. With multiple login possibility, a tbtfbf attacker with the capability to steal passwords could produce communication lapses which would instead appear as a lack of awareness by the user, causing disturbances and disruptions on both sender and recipient sides, and in the worst case loss of vital content without clear evidence what caused it. For example, in an email to a barrister a court document might get lost, and the order would not be fulfilled in time; and in the worst case a Riseup user might imagine it had been its own fault.

~~https://tinyurl.com/lb-artikel~~

Support Independent Media

We are 100% volunteer and depend on your participation to sustain our efforts!