I managed to (again) break into a private beta. I used a simple procedure, I copied the login form from another site and used the SE.com openID login. It didn't complain at all, and I wasn't committed to the site on Area51.

Does this need to be fixed? (I realize that it's no biggie if a few people break into private betas)

The older system used to check one's openid against a list of committers. The newer system only allows logging in via a (unique for each user) link, but the original checks in the openid system seem to have been removed since the OpenID login page no longer is there. It probably would be a simple fix to add these checks to /users/authenticate.

  • 12
    Your account must rather be terminated. :P – hjpotter92 Mar 25 '13 at 7:52
  • We'll take a look...but they're not meant to be 100% locked down, you can send a link and invite anyone you want for example...so we don't keep it on lock down. – Nick Craver Mar 25 '13 at 14:15
  • 1
    @NickCraver: Ah, I see. Like I said, not that important if folks know how to break in. I guess the point of a private beta is to keep out the "unwashed masses", if you will. :) – Manishearth Mar 25 '13 at 14:18
  • Surely there's some sort of Hacker badge we can give OP :P – Adam Rackis Mar 27 '13 at 17:34
  • 2
    @AdamRackis: Still 5 days for that :) – Manishearth Mar 27 '13 at 17:36
  • 3
    I think that it should count as a valid account if you can get into Reverse Engineering ;) – nneonneo Mar 31 '13 at 8:06

We no longer check against a list of committers. The old system was quite robust -- so much so that nearly every private beta had people emailing us for help getting in. We finally decided that making these secure was just not that important, and made it so anyone with the link could get in.

  • 15
    Excellent. I can now conduct my truly evil plans for beta sites >:D – Richard J. Ross III Mar 27 '13 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .