+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.ly/Forum-Visual-Basic-NET-Framework)
+--- Thread: eLogiS (/Thread-eLogiS)
eLogiS - Onlykl - 08-24-2013
Here is my eLogiS (Easy Login System)
http://www.screencast.com/t/1jkq1JRu
It uses php script to contact mysql server
RE: eLogiS - Sapientia - 08-24-2013
It looks pretty good, nice job!
RE: eLogiS - Onlykl - 08-24-2013
Thank you bro ^_^ I'm working now on update system that is connected with it
So there will be loggin and updating on same system, php scripts are working only on POST requests
RE: eLogiS - Thr - 08-29-2013
Okay... A few things about this that I must point out:
1. Are you using a regular HTTP web request? If so, your traffic can easily be sniffed; someone could either bruteforce the login URL, they could bypass it all in all with .NET reversing, they could sniff traffic to find out what you are sending and receive that back, etc. Anything like this isn't a safe login system, and can easily be bypassed.
2. Maybe make an email verification system? It's quite simple to be honest, and it will save you time with people that tend to like to spam emails. Also, I would suggest looking into SSL with an HTTP web request, so they can't get your POST info when you make a new account.
3. To be honest, this is just a few simple If statements. Make it a bit more dynamic
Have some protection in there as well that doesn't render your application vulnerable to particular attacks.4. Make sure that in your PHP script, you are cleaning POST data...This may not seem important to you, but it's really a big deal.
RE: eLogiS - idb - 08-30-2013
(08-29-2013, 03:10 PM)Thr Wrote: 2. Maybe make an email verification system? It's quite simple to be honest, and it will save you time with people that tend to like to spam emails. Also, I would suggest looking into SSL with an HTTP web request, so they can't get your POST info when you make a new account.
What exactly makes you think that you can stop someone from viewing the requests as plain text even if SSL is enabled if he's using HTTP protocol? SSL is a good start, but it's not enough.