You are not logged in. Please login or register.
PunBB Forums → General discussion → Warning : Security problem with google webaccelerator
PunBB administrators :
DO NOT use google webaccelerator ( http://webaccelerator.google.com/ ) while you are one your forum.
There is a security problem.
This is not a PunBB bug, it can appear with other forum or websites with personnal data cached.
http://groups-beta.google.com/group/Goo … b558802c4/
[David:moua]
If that's true, all hell is going to break loose.
How can I block it easyly ? With an .htaccess ?
If you're on a broadband connection already, then I don't see the advantage of using a proxy.
I used to run squid on my server and directed all web traffic through it. When we were on dial-up it was a great help but once we switched to DSL, it got in the way.
So anyone using the Google accelerator can become admins on phpBB forums, let the fun begin 
i just had a go with it, btw for you to be an admin an admin on that forum also has to use it since its a caching bug, and it really is fast, you notice sites loading instantly and images taking much longer than normal to catch up
Connorhd: Fine, just don't use it in these forums. At least not until it's fixed/considered safe.
So if I use this to sign on to my site as Admin, other people that use the accelerator will be able to gain access to the admin section of my forums?
you notice sites loading instantly and images taking much longer than normal to catch up
How is that good? Modern designs need to the images to work out where to put everything. It seems to me this will just amplify rendering/timing bugs particularly in Gecko browsers.
Connorhd wrote:you notice sites loading instantly and images taking much longer than normal to catch up
How is that good? Modern designs need to the images to work out where to put everything. It seems to me this will just amplify rendering/timing bugs particularly in Gecko browsers.
i didn't say it was good, its actually rather freaky and annoying 
It's even worse than I thought...Apparently GWA works by caching all pages (repeat ALL) you view on a central server. This includes pages that are password protected, email you read, private journal entries, or cradit-card statements.
The server then makes these pages availible for anyone else who goes to the same address with GWA on.
So, even if you password protect a forum - someone can still read it if it's been viewed by someone with GWA.
Whole article explaining here:
all except https and if your bank is not https get a new one
Looks like it might be even worse than "just" getting access to other peoples private pages: http://37signals.com/svn/archives2/goog … igners.php
do you think they thought this through? seems very "bodged"
Google is crap now, they have moved into so many new things that people download because it's Google but there not very good at any of it.
Why make an app that clicks all the links and ignores javascript warnings... how dumb is that.
anyway, here is fix
class ApplicationController < ActionController::Base
before_filter :disable_link_prefetching
private
def disable_link_prefetching
if request.env["HTTP_X_MOZ"] == "prefetch"
logger.debug "prefetch detected: sending 403 Forbidden"
render_nothing "403 Forbidden"
return false
end
end
endMah!
I need to block GWA from hitting my site, but this code you list is for web applications utilizing Ruby On Rails only. The only other fix I can find is by blocking all IPs using it and sending them a 403. But, this would kill off all visitors wanting to visit my site.
So, is there any other way to prevent GWA from royally screwing up my site? This is like a visrus! This is horrible!
http://fantomaster.com/fantomNews/archi … or-update/
Google Web Accelerator (GWA) IP range, namely: 72.14.194.0 - 72.14.194.255
You can block this with your .htaccess file
If I don't use GWA, can someone using it still get my log in info just by visiting my site?
Someone (while I'm at it I guess I may do it) needs to report this to Google.
Admins: DON'T USE GOOGLE WEB ACCELERATOR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
If I don't use GWA, can someone using it still get my log in info just by visiting my site?
From what I've read, I don't think so, but better safe than sorry.
http://fantomaster.com/fantomNews/archi … or-update/
Google Web Accelerator (GWA) IP range, namely: 72.14.194.0 - 72.14.194.255
You can block this with your .htaccess file
they're tryng to let more users in so there may be more users (and new IP addresses) over time. I reported it by the way.
http://fantomaster.com/fantomNews/archi … or-update/
Google Web Accelerator (GWA) IP range, namely: 72.14.194.0 - 72.14.194.255
You can block this with your .htaccess file
I did an IP-range ban.
PunBB Forums → General discussion → Warning : Security problem with google webaccelerator
Powered by PunBB, supported by Informer Technologies, Inc.