Problem regarding password sent in unencrypted way
With the new version of Bitdefender Total Security (2018-2019), we experience a new feature that warn us if password if sent trough url without using an ssl protocol.
If a user accepts to send information in an unencrypted way, we can add the url to the exception.
Doing some debugs...
We take a video input from url, using a custom port:
http://domain:15000/myuser/mypassword/video.ts
Bitdefender blocks the url BUT we can add into the exception list, here comes the problem;
if the url has a redirect to an ip (temp or permanent redirect), bitdefender is not seeing the exception anymore and block the ip.
Better explanation:
Bob opens vlc and pastes the url http://domain:15000/myuser/mypassword/video.ts , as loaded, this page redirect the url "domain" to one server's ip http://10.0.0.1:28383/myuser/mypassword/?token=jdhdhuchduchusdhc/video.ts (just an example), should bitdefender also see this new url (ip) whitelisted? Because for now this thing is not happening... Also, I'm not able to found anything to disable this type of check (password sent through unencrypted connection)... i tried to disable the function related but didn't work.
Don't know if this is a bug or whatever. For now i did a rollback to 2018 version
Comments
-
Hello,
If I understand correctly, this is not a bug. You say that if you whitelist a domain (for example www.domain.com), then when navigating there, if the website makes a request to another domain (for example www.domain123456.com), then the second one (domain123456) will not be whitelisted. This is intended. If you wish to whitelist the second domain, you can do that like you did for the first one. The information you need for whitelisting the second domain is in the main interface -> Notifications (you will see there a notification saying that the second domain was blocked, and you have a button for adding it to whitelist, or you can manually add it to whitelist).
If you want to completely disable this kind of notifications (private data, like passwords, bank accounts, phone numbers etc being sent unencrypted), you can do that by navigating in the main interface -> Protection -> Online Threat Prevention -> Settings -> Network Threat Prevention and disable the setting.0 -
On 9/20/2018 at 8:07 AM, Cosmin P. said:
Hello,
If I understand correctly, this is not a bug. You say that if you whitelist a domain (for example www.domain.com), then when navigating there, if the website makes a request to another domain (for example www.domain123456.com), then the second one (domain123456) will not be whitelisted. This is intended. If you wish to whitelist the second domain, you can do that like you did for the first one. The information you need for whitelisting the second domain is in the main interface -> Notifications (you will see there a notification saying that the second domain was blocked, and you have a button for adding it to whitelist, or you can manually add it to whitelist).
If you want to completely disable this kind of notifications (private data, like passwords, bank accounts, phone numbers etc being sent unencrypted), you can do that by navigating in the main interface -> Protection -> Online Threat Prevention -> Settings -> Network Threat Prevention and disable the setting.
1
The problem is: I tried to disable everything i could find (Protection -> Online Threat Prevention -> Settings -> Network Threat Prevention and disable the setting)
but it still continues to block the connection, if I put the domain into the whitelist settings, it allows me to surf...
If the domain is NOT in the exception list and Network Threat Prevention is disabled, it let me to surf the website in Google Chrome but not in vlc (if the domain is not in the exception list)
0 -
8 minutes ago, gregorst said:
The problem is: I tried to disable everything i could find (Protection -> Online Threat Prevention -> Settings -> Network Threat Prevention and disable the setting)
but it still continues to block the connection, if I put the domain into the whitelist settings, it allows me to surf...
If the domain is NOT in the exception list and Network Threat Prevention is disabled, it let me to surf the website in Google Chrome but not in vlc (if the domain is not in the exception list)
That is indeed a problem (which I cannot reproduce, unfortunately). Could you please use our support tool while reproducing this issue, upload the logs on google drive and PM me the download link? Here's how to use our support tool: https://www.bitdefender.com/consumer/support/answer/8919/
Thank you!0 -
