NYTimes web cookies

> Cookies and the NYTIMES subscription: NYTIMES.COM tries to store your
> userid and password in the cookie with keywords PW= and ID=. Problem is,
> it tries to encode them using 8-bit characters. Lucky for us, at this time
> NYTIMES.COM does not check if userid/password are valid, just that they're
> a part of the cookie!! So, just add these two lines to your junkbuster
> config:
> 
> wafer PW=0
> wafer ID=0
> 
> and nytimes.com will greet you as "0" and let you right in.


It doesn't check the PW or ID at all except the first time you log in.
After that it generates a new cookie titled NPLCNYT and that is the only
cookie it checks; the PW and ID are not required to be there at all.
If you delete the NPLCNYT cookie, it will check the PW/ID and generate
a new one.  An example cookie is below:

NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVua3M>
                    ^^^^^^^^^^^^^^^^^^^^^^|||||#####

The characters marked ^^^ appear to be random, and change every time a new
cookie is generated.  The ones marked ##### appear to encode the originating
IP address, and ||||| appears to be date/time.  The rest don't seem to change
(tho I only tried ID=cypherpunks PW=cypherpunks).  The server will still
accept the cookie if your IP address changes.

There does seem to be some sort of checksum on the data.  While the
relatively small area it uses to store the time and IP address wouldn't seem
to leave much room for this, I wasn't able to find a spoofed cookie that it
would accept - perhaps the checksum is included in the 'random' part.

ghio@temp0199.myriad.ml.org (Matthew Ghio) wrote:

> It doesn't check the PW or ID at all except the first time you log in.
> After that it generates a new cookie titled NPLCNYT and that is the only
> cookie it checks; the PW and ID are not required to be there at all.
> If you delete the NPLCNYT cookie, it will check the PW/ID and generate
> a new one.  An example cookie is below:
> 
> NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVua3M>

I put this wafer in my junkbuster-configfile and disabled all other cookies,
and NYTimes let me in without asking for a password, but after I read a few
articles, the site started behaving strangely, where the server would seem
to hang on certain pages, taking forever to send the html.

Interesting though.  Maybe we should hold a cypherpunks 'potluck' where
everyone trades cookies.  :)

nobody@REPLAY.COM (Anonymous) writes:
> ghio@temp0199.myriad.ml.org (Matthew Ghio) wrote:
>
> > It doesn't check the PW or ID at all except the first time you log in.
> > After that it generates a new cookie titled NPLCNYT and that is the only
> > cookie it checks; the PW and ID are not required to be there at all.
> > If you delete the NPLCNYT cookie, it will check the PW/ID and generate
> > a new one.  An example cookie is below:
> >
> > NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVu
>
> I put this wafer in my junkbuster-configfile and disabled all other cookies,
> and NYTimes let me in without asking for a password, but after I read a few
> articles, the site started behaving strangely, where the server would seem
> to hang on certain pages, taking forever to send the html.

I played around with nytimes.com some more and I'm certain that it does check
for the presense the ID= in the cookie (but not the value).

Apparently the following 2 is necessary and sufficient:
NPLCNYT=(whatever it tried to set it to)
ID=(anything; I used ID=0 to save bandwidth)

With ID=0, it says "welcome, 0" of the first page and I see no problems.

> Interesting though.  Maybe we should hold a cypherpunks 'potluck' where
> everyone trades cookies.  :)

A good idea. here are more of mine:

#.reference.com
wafer userid=cypherpunks@bwalk.dm.com
wafer passwd=cypherpunks

(I haven't been able to register cypherpunks@algebra.com on reference.com)

# amazon.com cypherpunks@algebra.com cypherpunks
wafer group_discount_cookie=F
wafer session-id=1451-4798095-404463
wafer session-id-time=886320000
wafer ubid-main=3578-1328899-434066
wafer cf=c90fe571f7b5f873

By the way, junkbuster does NOT strip cookies in secure http. Be careful.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Anonymous wrote:

| Interesting though.  Maybe we should hold a cypherpunks 'potluck' where
| everyone trades cookies.  :)

.nytimes.com    TRUE    /       FALSE   946684173       RDB
C802002E1B000055 5301026495323B0100000000000000

Anyone figured out how to get Amazon's Group-discount cookie to set to
true? :)

Incidentally, I edit my file something between daily and weekly, in
the hopes of generating bizare and worthless data for them.  I also
spend time clicking random links while on the phone to help fill my
cookie file with junk.

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

At 1:52 PM -0500 1/25/98, Matthew Ghio wrote:
>> Cookies and the NYTIMES subscription: NYTIMES.COM tries to store your
>> userid and password in the cookie with keywords PW= and ID=. Problem is,
>> it tries to encode them using 8-bit characters. Lucky for us, at this time
>> NYTIMES.COM does not check if userid/password are valid, just that they're
>> a part of the cookie!! So, just add these two lines to your junkbuster
>> config:
>> 
>> wafer PW=0
>> wafer ID=0
>> 
>> and nytimes.com will greet you as "0" and let you right in.
>
>
>It doesn't check the PW or ID at all except the first time you log in.
>After that it generates a new cookie titled NPLCNYT and that is the only
>cookie it checks; the PW and ID are not required to be there at all.
>If you delete the NPLCNYT cookie, it will check the PW/ID and generate
>a new one.  An example cookie is below:
>
>NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVua3M>


Anyone have something similar for the WSJ?

--Steve

Steve Schear <schear@lvdi.net> writes:

> At 1:52 PM -0500 1/25/98, Matthew Ghio wrote:
> >> Cookies and the NYTIMES subscription: NYTIMES.COM tries to store your
> >> userid and password in the cookie with keywords PW= and ID=. Problem is,
> >> it tries to encode them using 8-bit characters. Lucky for us, at this time
> >> NYTIMES.COM does not check if userid/password are valid, just that they're
> >> a part of the cookie!! So, just add these two lines to your junkbuster
> >> config:
> >>
> >> wafer PW=0
> >> wafer ID=0
> >>
> >> and nytimes.com will greet you as "0" and let you right in.
> >
> >
> >It doesn't check the PW or ID at all except the first time you log in.
> >After that it generates a new cookie titled NPLCNYT and that is the only
> >cookie it checks; the PW and ID are not required to be there at all.
> >If you delete the NPLCNYT cookie, it will check the PW/ID and generate
> >a new one.  An example cookie is below:
> >
> >NPLCNYT=AAAALw>AAAAAX9IUUWiPhfALqHZuSh2mUM0yzNOwGRReAAAAAsAAAAAY3lwaGVycHVua
>
> Anyone have something similar for the WSJ?

www.wsj.com is a pay site ($49 | $29 / annum).
Someone (not me) might want to post the details
of their subscription so everyone else could use it;
I suspect that the folks running wsj.com might object.

I messed around some more with various sites that use cookies.

1. .CNN.com wants to set the following 4 cookies for "cypherpunks cypherpunks":

PNAA=:Ypgxlx L. Egdfbd'sZAQF0:
(i.e. Random Q. Hacker)
PNAB=:01884:
PNAC=:CVGTEOZRSBY:
CNN_CUSTOM=1 path=/customnews

Problem is, the last one needs the path and there'e no way to fake path
in junkbusters wafer.  I simply put cnn.com in the cookie file momentarily,
logged in to let it set the cookie, then changed it to ">cnn.com" to filter
out any updates to these 4 cookies.

2. www.economist.com has a freebie "cypherpunks cypherpunks" account. The
cookie is:

wafer econ-key=4GgOaV1a

Perhaps someone cares to set up a paid account for group use.

3. foxnews.com doesn't allow "cypherpunks" (too long); "cypherpunk" is
already taken, and I couldn't guess the password.  Would the entity
responsible please set the password to what we all expect it to be. :-)

4. avweb.com (aviation site) cypherpunks cypherpunks
wafer AVweb_Auth=Y3lwaGVycHVua3M6Y3lwaGVycHVua3M=

5. .reba.com (country music) cypherpunks cypherpunks
wafer RebaNet%5FPWD=cypherpunks
wafer RebaNet%5FUID=cypherpunks

6. http://www.netstrike.com:8080/ cypherpunks cypherpunks
wafer WB-User=cypherpunks
wafer WB-Pass=cypherpunks

7. .citywire.com aka .nyrealty.com - manhattan real estate
 Random Q. Hacker cypherpunks@algebra.com cypherpunks
wafer primary_nyrealtyid=Ra34cbf1b0a7d1c
wafer nyrealtyid=Ra34cbf1b0a7d1c

8. .netscape.com, .mcom.com
wafer NETSCAPE_ID=10010408,121ee744
wafer NSCP-US-DOWNLOAD=pkjbcTTL5OYAAAAAYRr3d8towI7Tj4v3nJwgig==

(Should somebody set up a cypherpunks microsoft login for downloading
all the patches and bug fixes they put out?)

Given the number of these things, it seems that sending them out with
every nntp request as a wafer wastes too much bandwidth.  Can someone
recommend a good program for editing the cookie file? I'm too lasy
to write it myself.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps