Describe the bug
The user login is transmitted via unsecured HTTP to tv.deezer.com.
So plain text email address and a MD5 hash of the password are transmitted.
However MD5 is not a strong hash function as it could be easily reversed.
Environment (optional if log file provided) :
affected OS: any
affected addon version: 2.0.5
Steps to reproduce
1) Open Wireshark (or any packet interception app) and start capture
1) Open Kodi and try authenticate to Deezer
1) You should be able to view the corresponding packet in Wireshark with endpoint : http://tv.deezer.com/smarttv/authentication.php
1) Now you have access to the user email its hashed password
How to resolve
Please consider using HTTPS and if possible SHA256 hash.
You might also enable HTTPS for the streaming.php endpoint.
Describe the bug
The user login is transmitted via unsecured HTTP to tv.deezer.com. So plain text email address and a MD5 hash of the password are transmitted. However MD5 is not a strong hash function as it could be easily reversed.
Environment (optional if log file provided) :
Steps to reproduce
1) Open Wireshark (or any packet interception app) and start capture 1) Open Kodi and try authenticate to Deezer 1) You should be able to view the corresponding packet in Wireshark with endpoint : http://tv.deezer.com/smarttv/authentication.php 1) Now you have access to the user email its hashed password
How to resolve Please consider using HTTPS and if possible SHA256 hash. You might also enable HTTPS for the streaming.php endpoint.