Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I managed to (again) break into a private beta. I used a simple procedure, I copied the login form from another site and used the openID login. It didn't complain at all, and I wasn't committed to the site on Area51.

Does this need to be fixed? (I realize that it's no biggie if a few people break into private betas)

The older system used to check one's openid against a list of committers. The newer system only allows logging in via a (unique for each user) link, but the original checks in the openid system seem to have been removed since the OpenID login page no longer is there. It probably would be a simple fix to add these checks to /users/authenticate.

share|improve this question
Your account must rather be terminated. :P – hjpotter92 Mar 25 '13 at 7:52
We'll take a look...but they're not meant to be 100% locked down, you can send a link and invite anyone you want for we don't keep it on lock down. – Nick Craver Mar 25 '13 at 14:15
@NickCraver: Ah, I see. Like I said, not that important if folks know how to break in. I guess the point of a private beta is to keep out the "unwashed masses", if you will. :) – Manishearth Mar 25 '13 at 14:18
Surely there's some sort of Hacker badge we can give OP :P – Adam Rackis Mar 27 '13 at 17:34
@AdamRackis: Still 5 days for that :) – Manishearth Mar 27 '13 at 17:36
I think that it should count as a valid account if you can get into Reverse Engineering ;) – nneonneo Mar 31 '13 at 8:06
up vote 18 down vote accepted

We no longer check against a list of committers. The old system was quite robust -- so much so that nearly every private beta had people emailing us for help getting in. We finally decided that making these secure was just not that important, and made it so anyone with the link could get in.

share|improve this answer
Excellent. I can now conduct my truly evil plans for beta sites >:D – Richard J. Ross III Mar 27 '13 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .