What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

When I sent a link to my question to co-workers (we're on the same LAN, so perhaps we look to have the same IP to the SO site), they were essentially logged in as me and could perform all the functions as if they were logged in as myself.

Did they get into my session by me simply sending them a link to my question?

This seems like a horrible bug, or am I missing something?

My OpenID provider is: myopenid.com

At work, my coworkers and I are all behind the same proxy.

share|improve this question
    
Stack Overflow only uses OpenID for logging in, so that piece of information is irrelevant. –  Brad Gilbert Nov 12 '09 at 15:49
2  
It would be helpful however, to know which OpenID provider you use. Also does your company use a proxy? –  Brad Gilbert Nov 12 '09 at 15:51
    
Ack, you are correct. Edited my question, taking out the irrelevant piece. –  program247365 Nov 12 '09 at 15:51
    
@Brad Gilbert It's myopenid.com. Yes my company definitely uses a proxy. –  program247365 Nov 12 '09 at 15:52
    
This seems like a pretty large hole in OpenID if its true. –  dlux Nov 12 '09 at 18:27
1  
If his proxy is caching cookies, then it's a pretty large hole in his proxy... –  Shog9 Nov 12 '09 at 18:45

4 Answers 4

What proxy are you using? This sounds like either a bug with myopenid or a big problem with your proxy config. I use myopenid and have never had this happen when sending things around to my coworkers. I would first bark up the proxy server tree as myopenid would stand to lose quite a lot if this was a widespread issue for them, authentication being their business and all.

I'd suggest log out of all the trilogy sites, then log out of myopenid and click around SO while not logged in for a little while. That should clear any garbage from your proxy chain. See if your coworkers are still accessing your session after that. If not, log in again and then have them try again. If they are still able to connect as you then talk to your proxy admin and / or myopenid support.

share|improve this answer

Not really possible since the cookie your local browser holds is the key to your identity.

The only way I can think of this happening, is if you had logged in to Stack Overflow on that user's PC, in their browser.

share|improve this answer
    
I concur, perhaps this is what happened: meta.stackexchange.com/questions/29459/… However, not sure how it stayed there so long. –  program247365 Nov 16 '09 at 18:31

you could always try opening the page in a browser that you never use, to see if it's really possible for a user from your company that's never been to your site. it could be that your proxy is really stupid, and it's caching the last version of the file that was sent, regardless of the headers sent by the site.

share|improve this answer

All I can figure is, that I perhaps did log into one of my co-workers machines as myself in his Firefox browser. However, I believe it was several months ago, and I did not check "keep me logged in" on myopenid.net.

My company does use Webwasher

Still not sure how my credentials could be stored in his browser for months.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .