Conversation

@elena @aral I couldn't resist, so I've wasted my precious time looking at "W Identity" today.

Things are not right.

It is basically a repurposed https://github.com/PeterWaher/IoTGateway

Just look here: https://root.widentity.eu/Settings/Master.md

It has a socks4(?) open on port 1080, some xmpp stuff on 5222 and 5269, another (seemingly broken) version of the website on 8088.

The following pages are accessible without auth:

(found by a simple "egrep -LR 'Privilege:|Login:' * |grep md | grep Root" through the source)

Others pages also exist (no 404), but are only available after login.

Which brings me to the biggest problem of all.

This is an ADMIN interface.

Nobody should ever put an admin interface to an identity management platform on the internet.

#WSocial #Widentity