42

I managed to (again) break into a private beta. I used a simple procedure, I copied the login form from another site and used the SE.com openID login. It didn't complain at all, and I wasn't committed to the site on Area51.

Does this need to be fixed? (I realize that it's no biggie if a few people break into private betas)

The older system used to check one's openid against a list of committers. The newer system only allows logging in via a (unique for each user) link, but the original checks in the openid system seem to have been removed since the OpenID login page no longer is there. It probably would be a simple fix to add these checks to /users/authenticate.

6
  • 12
    Your account must rather be terminated. :P
    – hjpotter92
    Commented Mar 25, 2013 at 7:52
  • We'll take a look...but they're not meant to be 100% locked down, you can send a link and invite anyone you want for example...so we don't keep it on lock down. Commented Mar 25, 2013 at 14:15
  • 1
    @NickCraver: Ah, I see. Like I said, not that important if folks know how to break in. I guess the point of a private beta is to keep out the "unwashed masses", if you will. :) Commented Mar 25, 2013 at 14:18
  • Surely there's some sort of Hacker badge we can give OP :P Commented Mar 27, 2013 at 17:34
  • 2
    @AdamRackis: Still 5 days for that :) Commented Mar 27, 2013 at 17:36
  • 3
    I think that it should count as a valid account if you can get into Reverse Engineering ;)
    – nneonneo
    Commented Mar 31, 2013 at 8:06

1 Answer 1

20

We no longer check against a list of committers. The old system was quite robust -- so much so that nearly every private beta had people emailing us for help getting in. We finally decided that making these secure was just not that important, and made it so anyone with the link could get in.

1
  • 16
    Excellent. I can now conduct my truly evil plans for beta sites >:D Commented Mar 27, 2013 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .