Warning: iLok site IS NOT secure!

[dkrz]

Message quoted from Mozilla browser—>

The information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?

This is the alert I get when attempting to log-in to the official iLok (www.iLok.com) user services server. I wanted to check the accounts on my iKey to make sure all was well with my new Panther installation along with my third party plug-ins registered to my iKey, etc...

I logged in anyway and all the account information (three licenses in all) are in order, but - WTF? Someone can just grab my password on the fly and mess with my iLok account? If someone logs in as me, they would clearly see the iKey serial number and all of it’s contents!!

Anyone else care to verify this?

I also get a similar warning from Explorer. (Safari is unsupported by Pace @ iLok.com)

dk
-------------------
Dual 1.25GHz FW800 / 512MB ram
OS10.3.1
PTLE 6.2.2 - DIGI 001
100GB OWC Firewire (Oxford 911) Audio HD
DigTranslator 2
McDSP Analog Channel
Waves Native Power Pack - v4

[dkrz]

Hmmm... Can't believe nobody cares about this.

dk

[chrispnyc]

I care!!! I haven't moved to OS X yet (next week) so I haven't encountered this yet. It is not right...that's for sure. Have you tried contacting Pace or Digi about all of this?

[cwhite771]

It is a bit ironic that tpart of the idea behind the iLok is to keep plugin authorizations more secure to prevent piracy, etc., yet they can't seem to spend a few hundred $$$ for an encrypted SSL connection. Pretty weak.

Granted, it's not really easy for someone to intercept that information, but it is possible.
---
c

[dkrz]

It is a bit ironic that part of the idea behind the iLok is to keep plugin authorizations more secure to prevent piracy, etc.,

My thoughts EXACTY!!!

I'll try to contact Pace today and Digi. umm.. any Digi guys check out this thread yet?

dk

[Ultraslide]

There are other ways to secure information over the internet other then SSL. SSL secures the connection but you can use PAM / MD5 hashes or Windows Digest Auth. to encrypt information (but not the connection). So your data is scrambled but the connection isn't.

Looks like thier web server is running Linux with Apache and mod_SSL.
http://uptime.netcraft.com/up/graph/?host=www.ilok.com

Couldn't really say much more , cause I'm not using an iLok yet. Maybe the auths are coming from a different server (i hope so).

Maybe send them a polite note letting them know you'd sleep better with an SSL connection.
The security concerns may be annoying for you, but are potentially devistating for them.

cheers!

the 'slide