<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I’d like to remind everyone that OsmAnd is an open app, with both mobile and webside code available on GitHub. The author would be grateful if anybody here updated the php code to use OAuth instead of login and password:<div class=""><br class=""></div><div class=""><a href="https://github.com/osmandapp/osmandapp.github.io/tree/master/website" class="">https://github.com/osmandapp/osmandapp.github.io/tree/master/website</a></div><div class=""><br class=""></div><div class="">Ilya<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">12 янв. 2018 г., в 16:15, Darafei Komяpa Praliaskouski <<a href="mailto:me@komzpa.net" class="">me@komzpa.net</a>> написал(а):</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">Hi,<br class=""><br class=""><a href="https://osmand.net/osm_live" class="">https://osmand.net/osm_live</a> requests user's OSM password and e-mail in exchange of promise of bitcoin payment.</div><div class=""><br class=""></div><div class="">There is no way to check that the password is not being collected, with or without knowledge of service authors. At least 1100 accounts may be affected.</div><div class=""><br class=""></div><div class="">Simplest attack vector may be "if password matches on google drive of this e-mail and there's a backup of wallet there and password matches there too, get all the money from there".<br class=""><br class="">What can be done on <a href="http://osm.org/" class="">osm.org</a> side to mitigate it?<br class="">Can password reset be forced for affected users, and for those who keep coming to that form?</div></div>
_______________________________________________<br class="">dev mailing list<br class=""><a href="mailto:dev@openstreetmap.org" class="">dev@openstreetmap.org</a><br class="">https://lists.openstreetmap.org/listinfo/dev<br class=""></div></blockquote></div><br class=""></div></body></html>