Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was messing around with my settings on a old D-LINK DIR-600 wireless router. I've been tweaking the settings a bit for various purposes. So when I recently go to type the first few digits of the IP address, but then autocomplete shows me the rest of the IP address because I've visited it a few times. I don't look at the ending of it, I just hit enter. Once I hit enter though, I realize that the adress was 192.168.0.1/index.asp and not just 192.168.0.1. When I enter the second link, it prompts me like normal for my password. However, when I click on the second link, it doesn't ask for a password. I get free access to the router, and I don't even need to hack anything!

Is this because Chrome has a cached copy and caches everything that's not HTTPS? Chrome says it's not encrypted, so is that just Chrome catching the copy? I don't mind if that's the case, but if not, it's a huge security exploit that if you can just log into a router (let's say no password) you can take over the whole network. Yes, it can be fixed with a simple factory reset using the button on the router, but still, it might be too late, especially if the neighbors hate you. :P

Everybody who I even let close to my router is careful with the password and probably doesn't even know what port forwarding is, but still, people hack routers a lot.

share|improve this question
1  
What's the question exactly you told chrome to save your password doesn't mean anyone can access it easily –  Ramhound Sep 28 '13 at 22:34
    
@Ramhound It's not autocomplete for the password. I meant autocomplete in the address bar. –  Annonomus Penguin Sep 29 '13 at 13:48
    
I know that chrome can auto fill username and password –  Ramhound Sep 29 '13 at 14:15

1 Answer 1

Your browser likely still has a cookie that records the token used by the little web server in your firewall and that's being queried by the browser and reused.

I'd bet that if you cleared all your "Private Data" from your browser, you'd be prompted as normal.

share|improve this answer
4  
Or if you tried in incognito mode - that way there's no saved cookies. –  nhinkle Sep 28 '13 at 21:43
    
@nhinkle incognito mode: still no effect. I've also logged on this computer before so if it remembers the computer... –  Annonomus Penguin Sep 29 '13 at 13:49
    
Remembering the computer is done with Cookies, as mentioned above. –  Magellan Sep 30 '13 at 0:07
    
@Magellan I mean with IP addresses. Incognito mode doesn't save cookies yet it still logs on. –  Annonomus Penguin Feb 16 at 23:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.