364076 - To enter an account of hotmail without knowing the name user and the password - keywords: (hotmail user password nonorder security problem log in login)

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[D1e6o]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; es-AR; rv:1.8.1) Gecko/20061010 Firefox/2.0 Alexa Toolbar
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-AR; rv:1.8.1) Gecko/20061010 Firefox/2.0

	Automatically translated text:
Cuando cierro sesión en hotmail abre la siguiente página: http://latam.msn.com/?lc=3082 (no en hotmail live). Presiono el link de hotmail:http://g.latam.msn.com/0nwesxl0/00/02? (por seguridad lo envío incompleto), que se encuentra en la esquina superior izquierda, abre la misma sesion sin pedir el nombre de usuario y contraseña	 	
When I close session in hotmail opens the following page: http://latam.msn.com/?lc=3082 (not in hotmail live). I press the hotmail Link: http://g.latam.msn.com/0nwesxl0/00/02? (by security it incomplete shipment), which one is in the left corner superior, opens the same session without requesting the name of user and password



Diego Durante

Reproducible: Always

Steps to Reproduce:
1.to open session in hotmail and to use it normally
2. 	
to go to the file or to select the mentioned Web (http://latam.msn.com/?lc=3082) or to insert it directly (in another country it can vary this page) 
3.to press the Link of hotmail in the left superior corner

Actual Results:  
I entered the last account of hotmail entered without knowing user nor password even without knowing as it is the user name! (it does not work if they opened to mail Windows live)

Expected Results:  
 	
to request the user and password 

 	
it does not work with iexplorer

Comment 1

[Daniel Veditz [:dveditz]]

You're not logging back into a random account are you? You say "without knowing the user name", but from the description it sounds like you're just not completely logged out even though Hotmail said you were.

That would be a completely different problem than being able to log into other people's accounts, and is most likely a site problem (relying on some IE-specific quirk).

When you're in the supposed logged off state you can open the Options dialog from the Tools menu, Click on the Privacy tab, and then look at your cookies (might be several hosts, *.msn.com, *.hotmail.com, *.live.com). I bet you can clear these and get totally logged out, and if so that will pinpoint the problem to a cookie setting/clearing one.

Comment 2

[Carsten Book [:Tomcat]]

No Reply to comment #1 and the steps to reproduce still work for me on Firefox 2.0.0.4 and Trunk. -> Incomplete

I tested this with Windows Live Mail (which was released a few days ago). When i`m logged out completely i get with the provided link   (http://latam.msn.com/?lc=3082) or the german live mail site and the hotmail login-button the Hotmail Login Window. I still need then my emailadress and password. 

So i need to know username and password. 

D1e6o: Is this still an issue? please see also the comment #1 from Dan Veditz.

Comment 3

[D1e6o]

	
No longer I am having this problem with the 2.0.0.3 version of firefox… Apparently it was repaired. GREETINGS!