Develop Bugs

Android spamware (exactly like PC)

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I don't know what I had installed for this to happen, last programs I installed from the market before this happened was two airhorn apps. It added fake search and market widget. Changed my homepage URL.
I thought this happening us pretty wild on a cell phone.. I also have bitdefender security installed.
So I don't know what gives. Thought I post to give heads up.
.: sent from my Samsung Galaxy S II Epic 4G Touch :.

bit defender is about worthless and is a resource hog to boot.

I just noticed the Home page in Stock Browser changed to the same.
Did not install any new apps from Market or anywhere else in about a week, just did some updates yesterday.
I have Lookout installed, will do a full scan and look around in TiB for any new apps installed (by Date)...
Weird

It's probably a library packaged within an app that pushes ads and garbage to your device. MP3 Downloader is one of the biggest offenders in sending random ads to your notification bar even when you're not using the app.
This is your best bet in finding the offending app: https://market.android.com/details?id=com.denper.addonsdetector&hl=en (Addons Detector)
---------- Post added at 08:38 AM ---------- Previous post was at 08:37 AM ----------
Check this out too: http://forum.xda-developers.com/showthread.php?t=1343667

Badass thanks for the links
.: sent from my Samsung Galaxy S II Epic 4G Touch :.

My browser was redirecting to: "http://start.infospace.com/?sourceid=6&app=13]....".
Ran 'Addons Detector' and 'AirPush Detector' to find out if one of these AirPush addons is in one of the apps.
With Addons Detector I used the filter 'Push Notifications', did not detect anything.
Had to clear Cache and Data in Settings>Applications>Internet to get back to be able to set my home page to google.
Now after a reboot, so far so good. Still need to figure out what rogue app did this!
[EDIT] Found this thread:
http://androidforums.com/android-ap...rt-infospace-com-has-hijacked-my-browser.html

always always always read a ton of reviews, download count and permissions carefully.
i wont even touch stuff like fart or airhorn,downloading apps(wallpapers,ringtones,mp3's) for this very reason. also another reason to carefully and frequently logg and monitor system activity and background activity. this is also why i strip down my system folder,etc to avoid any risk... every app running could be seen as a potential victim of an exploit. so far my paranoia has led to absolutely no problems, although i have seen some strange activity before for instance. infinite black a game i used to play would always be running in SERVICE mode in the background NOT cached this would be the type of behavior that should warrant removal.

My wife got some airpush crap on her phone from the latest update to the LivingSocial app. She uninstalled it and the notifications have seemed to go away. :fingerscrossed:

Always mark apps using airpush as malware, one star and say so in the comments to discourage devs from using it.

I guess that we are finally starting to see the downsides of Google's quick app approval process (as compared to iOS). Let's hope that the big G does something to thwart this nonsense sometime soon, but in the meantime, the best weapon on our side is knowledge. Make sure you know which app is causing this unwanted behavior, help your friends learn how to detect which app is the culprit, and urge them to uninstall/rate as needed.
I've only ran into one so far, MP3 Downloader, which was promptly uninstalled despite it's generally awesome usefulness.
I can't wait until root apps start messing with the hosts file. That's when the really fun redirecting starts!

Install and use these:
https://market.android.com/details?id=com.airpush.optoutapp&hl=en
https://market.android.com/details?id=com.brosmike.airpushdetector&hl=en

I'm also one of the victims for the start.infospace.com malware and im using the international GS2. My suspect is that i got infected after i installed this app called "Deal or BE Millionaire". Search shortcut has been created on my homepage instantly after i installed that app (Deal or BE Millionaire). Few days later (normally i would use opera mini as my main browser), when i opened up the stock browser, i was directed to the start.infospace.com URL instead of my actual homepage which is google. I found it strange that my stock browser was hijacked so i looked around the web for insights and this was what i did which seems to resolve the issue. Delete all the shortcuts created by the malware app, reset the stock browser to default, and also go to manage applications and clear data for the infected app (in this case it was "Deal or BE Millionaire" for me), and finally uninstall the app and reboot phone.

Funny I'm reading this now as about 30 min. ago my wife installed a live wallpaper on her phone and an ad popped up on her home screen. I uninstalled the live wallpaper & it went away.

Not sure if this will help but should do. Gemini app manager which I got off the market will show you exactly what each app on your device can access and detects advertising code etc in them as well so should be able to help narrow down apps causing issues.
As regards ios approval process stopping malware, while it it is better at it than googles process you can still get malware on ios via the market as evidenced by the report at november www.bbc.co.uk/news/technology-15635408 as they changed the market last year and malware got on it undetected and was working on non jailbroken devices.
I hate spam but have been lucky and worst I had is those ones that send notification messages. I refuse to use apps that use that advertising method as to me ads should be in the app rather than spam your notification bar.
Dave
Sent from my LG P920 using Tapatalk

For the time being I can at least take comfort in the fact that removing any suspected malware, adware or supposed virus off our devices is an easy fix. Unlike my windows based pc.
I've pointed this out on another section of this site when I had my Evo: But why do antivirus/malware apps made for Android only scan an app after its been installed, shouldn't it be scanned prior to installation? Or am I missing something here?

[REF] Air Push - Ad's or SPAM in the Notification Bar

This is becoming an increasingly frequent nuisance around the forum for a lot of users, so I thought I would start a thread with a list of Known Air Push Ad Apps.
To fix this issue you can download Addon Detector or Air Push Detector from the market and it will scan your apps and let you know which apps you have installed have Air Push Ads in them. I found that Addon Detector was able to detect an app that Air Push Detector wasn't able to so that is my preferred scanning app. Once you find an installed app with Air Push Ads simply remove the app to solve the unwanted ads in your notification bar.
List Of Apps with known Air Push Ads:
Bloat Freezer
MP3 Download Pro
Some GoLauncher Themes
As people post known Air Push Ads Apps I will update the OP with them.

A very helpful and constructive thread. I was going nuts trying to figure out what was spamming me. Bloat freezer was the culprit and it is no longer on the market. Good riddance. App quarantine has the same functionality, a better interface, and is completely ad_free.

Thanks
Sent from my SGH-T989 using xda premium

Recently had a Go Launcher theme doing this..drove me nuts.
Are these detector apps working off a blacklist or somehow scanning the apps for code?

Rekzer said:
Recently had a Go Launcher theme doing this..drove me nuts.
Are these detector apps working off a blacklist or somehow scanning the apps for code?
Click to expand...
Click to collapse
I believe they scan the app.
Sent from my SGH-T989 using xda premium

I released an app that can block Airpush ads on Rooted devices.
To get more info go to the market: https://market.android.com/details?id=pl.byq.airblocker

I don't see the device management In this app to freeze, I was using bloat freezer to freeze the ota update
treo...not! said:
A very helpful and constructive thread. I was going nuts trying to figure out what was spamming me. Bloat freezer was the culprit and it is no longer on the market. Good riddance. App quarantine has the same functionality, a better interface, and is completely ad_free.
Click to expand...
Click to collapse
Sent from my SGH-T989 using XDA App

Aww serious? I thought I was today's ipad winner :-(
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But eff apple.
Sent from my SGH-T989

Go to settings and uncheck hide system services.
rg1973 said:
I don't see the device management In this app to freeze, I was using bloat freezer to freeze the ota update
Sent from my SGH-T989 using XDA App
Click to expand...
Click to collapse

My GF has one of these apps on her phone that almost always display an icon in the status bar. Quite annoying indeed. Can't wait to rid her of the offending app(s). Thanks, OP! Just to be sure, Addon Detector doesn't require root, correct?

jaekidd1012 said:
My GF has one of these apps on her phone that almost always display an icon in the status bar. Quite annoying indeed. Can't wait to rid her of the offending app(s). Thanks, OP! Just to be sure, Addon Detector doesn't require root, correct?
Click to expand...
Click to collapse
No root required.
Sent from my SGH-T989 using xda premiumno

Is it possible that when i unstalled bloat freezer it deleted the device management because I no longer see it showing up I did uncheck the mode system services btw
treo...not! said:
Go to settings and uncheck hide system services.
Click to expand...
Click to collapse
Sent from my SGH-T989 using XDA App

"movements on the water" this app have Airpush (com.yukka.livewallpaper.water)
very useful Post.
I use Airblocker for detect (root needed)

airpush detector has been 1 of the best apps in saving me money.. ive got so many 3rd party charges on my phone and best way was to install this and any stupid app that pushes these stupid things through my phone was deleted wayyy before damage could be done.. good job dev and keep it up and i'll be using ur app forever..

great app
ByQ_Develop said:
I released an app that can block Airpush ads on Rooted devices.
To get more info go to the market: https://market.android.com/details?id=pl.byq.airblocker
Click to expand...
Click to collapse
OP you gotta add this in the OP. This app gets the done job. Not only it shows whats sending the ads, it blocks them too if you dont wanna remove the apps thats sending the ads.
Check it out

magic x-ray live wallpaper

Villagesim 1 it's fake, loaded with air push + another Ad bot pay load
the real developer of Villagesim only released Villagesim 2 free, and Villagesim 4 paid

Thanks for this app, it is nice having the peace of mind. No bad apps found out of 53.

Iris is another app that uses airplay. Even the paid version has it enabled.
Air Play is basically adware. It gets hooked into the app using the Air Play SDK which then gives Air Play the same access to your phone as the app that it's built into. This usually means it has access to your personal data which it most likely collects.
Here is a quote from Air Play's web site about how it works:
"Developers add the Airpush client SDK in their Android™ app, which consists of an ultra-lightweight JAR file like most mobile ad networks. When executed once from the main activity of an Android™ application, the Airpush client utilizes Android™ OS's AlarmManager framework to schedule ongoing server polling events a few times per day. If an ad is polled from the server it is cached until optimal display time, which is algorithmically determined by the server."
My 2 cents: beware of any ad supported apps that ask for permissions they do not need. They most likely use those permissions for their ad API's to gain access to your personal information.

aaaaargh push
a dodgy app called 'my settings', could only find with addon detector. was getting spammed hourly from that beearch. Cheers and happy festivus to the android community.

Adobe Touch Apps [Sideload/Cloud Only as of 7/26/12]

Has anyone heard whether Adobe Photoshop Touch or any of their other tablet apps making it to the N7?
Was super pumped to blow my $25 credit on them, now I am disappoint.
Sent from my Nexus 7 using xda premium

arrjaytea said:
Has anyone heard whether Adobe Photoshop Touch or any of their other tablet apps making it to the N7?
Was super pumped to blow my $25 credit on them, now I am disappoint.
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
Well, shouldn't really take much considering Photoshop Touch works when sideloaded for me.

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
They work. Photoshop and Proto are the only ones that I've tried. I didn't get 'em from the market though. I downloaded them with my cloud subscription.
Sent from my Nexus 7 using xda premium

luchoster said:
They work. Photoshop and Proto are the only ones that I've tried. I didn't get 'em from the market though. I downloaded them with my cloud subscription.
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
Good to know. Bummer it appears I won't be able to use my PlayStore credit though.

How to download?
I have a cloud subscription. Can you tell me where to download the Proto apk?
Thanks!

Anyone know a market fix app so I can download apps that are 'incompatible'? -Ara
Sent from my Nexus 7 using xda app-developers app

That sucks, maybe you can contact Google about it.
If I had the apps, I'd gladly send you the apks but unfortunately I don't

I have a Creative Cloud subscription, would you please tell me where to download the touch apps APKs?
Sent from my Nexus 7 using XDA Premium HD app

If I use stock 4.1.1 and stock 4.1.2, I can see and install Photoshop Touch.
Anything other than stock, including using CM10 or AOKP roms, then I can see but cannot install Photoshop Touch with a message saying it is incompatible with my rom.

My solution was to install an old apk of the software (found on the web, any will do). Then, since I actually bought the app, it simply proposed me to update through the Store.
Sent from my Nexus 7 using xda app-developers app

thegrau said:
My solution was to install an old apk of the software (found on the web, any will do). Then, since I actually bought the app, it simply proposed me to update through the Store.
Click to expand...
Click to collapse
I must be doing something wrong. Attempted the same thing, I'm not rooted nor do I currently wish to be (long story there, I'll leave my Xoom to be the rooted one for now) but as it stands, this did not work for me.
Upon installation on 4.1.2, the market recognized Adobe Proto and Adobe Ideas were installed. I cannot get these to update via the store since they are still seen as incompatible with my Nexus 7. Great...
And I paid for those two.

[edit]
Just had an email response from Google Play regarding the purchase of the app and subsequently being unable to reinstall after a factory reset.
Here is what they wrote:
Hi Stephen,
Thanks for writing back. I do see that you've done a factory data reset. I'm sorry to hear you're still experiencing this issue. Apparently you were able to download the app before but it is correct that the app isn't actually compatible with the Nexus 7.
If you're still not able to find a certain app, please keep in mind apps that aren’t compatible with your device are hidden when you search for them on Google Play. Developers of Android apps can choose to filter devices based on a variety of criteria, including Android OS version, carrier, location, or even screen size. According to our records, Adobe Photoshop Touch is incompatible with your device because it doesn't match the developer's specifications on for the device's screen density.
Because you were able to purchase this app and are now unable to use it, I've gone ahead and filed this refund request on your behalf - you'll receive another email within 14 business days confirming that the request has been processed.
Thanks in advance for your patience, and if you have additional questions or if you don't receive a second email with this confirmation, please let me know.
Regards,
Eddie
The Google Play Support Team
Click to expand...
Click to collapse
Guess that answers one question, however I still can't understand how I was able to purchase it directly from Google Play. The app itself runs perfect on the N7, so maybe it's now up to Adobe to support our device....

Same here.. sideloaded it works perfectly fine...
Shamushand said:
Well, shouldn't really take much considering Photoshop Touch works when sideloaded for me.
Click to expand...
Click to collapse

I spent two+ hours last night trying to spoof my N7 as various compatible tablets so I could download it, and succeeded only in soft-bricking (fixed by reflashing OTA).
It looks like Google has closed some/all of the loopholes that used to allow you to fool the store. Nothing I tried worked.

with my current rom i am able to buy the app on the store. my rom is aosp based. no tweeks to the market that i know of. no build prompt changes. no idea what im doing right but it is not hidden or unavailable in any way for me

I'm on stock 4.2.1 and it shows up for me. 9.99
Sent from my Nexus 7 using Tapatalk 2

Yea they just recently updated it make it officially work on the N7. It's totally worth the money btw, Ive been using it since it was released and now that it can edit images up to 12mp it's SUPER useful.

Ad blocking apps removed from play store...

...discuss
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

I thought it would've happened months ago, frankly. The widespread use of these apps had finally reached a threshold for Google to make a decision about this.
The apps will still be available for sideloading, to those who are inclined. The biggest oversight seems to be the fact that these ad blocking apps help to make web browsing a lot more enjoyable (and faster, and cheaper on data costs). I hope that a fundamental change is made to allow for in-app ads while blocking internet ads (as of now, the hosts file is manipulated and is therefore not possible).

anyone have it to share?

ibcenu said:
anyone have it to share?
Click to expand...
Click to collapse
I got you
v0.8.44
www.dropbox.com/s/9ps2jbpz0oyr1ew/com.bigtincan.android.adfree.apk

So will Google also ban multifunction apps from Play that have blockers in them such as ROM Toolbox? (I just upgraded to paid version earlier today)
What's next, no root apps at all? Wouldn't surprise me. LOL it wasn't so long ago that iGoogle was a product.
Sent from my SPH-L710 using xda premium

Slomodrop said:
So will Google also ban multifunction apps from Play that have blockers in them such as ROM Toolbox? (I just upgraded to paid version earlier today)
What's next, no root apps at all? Wouldn't surprise me. LOL it wasn't so long ago that iGoogle was a product.
Sent from my SPH-L710 using xda premium
Click to expand...
Click to collapse
I suspect that a reasonable way to handle this is: remove apps that have the sole purpose of manipulating the hosts file, and issue warnings to developers of apps which do the hosts stuff as one of multiple root functions.

They would probably be okay if they only blocked web ads. Blocking app ads, surprised these were ever allowed.
Sent from my SPH-L710 using xda app-developers app

I was wondering why Adaway & Adfree stopped showing up in my list of apps on play store. Good thing I got them when i did

Also the latest version sent out on Play Store was v0.8.47 and here is the download link
https://www.dropbox.com/s/ca4l9f0abdbvrl1/AdFree_0.8.47.apk
Hope this can help

Re: umm no ad blocks on Google play?
arturox said:
Also the latest version sent out on Play Store was v0.8.47 and here is the download link
https://www.dropbox.com/s/ca4l9f0abdbvrl1/AdFree_0.8.47.apk
Hope this can help
Click to expand...
Click to collapse
Really? Weird, because I took the last update before it just disappeared
But ok, thanks

CNexus said:
Really? Weird, because I took the last update before it just disappeared
But ok, thanks
Click to expand...
Click to collapse
My dude.. Your always there when I need something
Sent from my SPH-L710 using Tapatalk 2

Ad block plus is free from their site.
http://adblockplus.org/en/android
But i think their servers may be overloaded. It took about 10 tries for a successful download.
Sent from a planet far far away.

Can google do this legally? If MS can be sued to have IE installed as standard, which google and mozilla argued restricted consumer choice.. well if consumer doesnt want ads, doesnt he have right to block the ads on his own device?

cteq1 said:
Can google do this legally? If MS can be sued to have IE installed as standard, which google and mozilla argued restricted consumer choice.. well if consumer doesnt want ads, doesnt he have right to block the ads on his own device?
Click to expand...
Click to collapse
They aren't saying the end user can't block ads they just arent providing the tools to do it.
It boils down to ads make people money. All the apps that have ads make that developer money so they can offer their app for free in most cases.
Sent from a planet far far away.

Speedin07si said:
They aren't saying the end user can't block ads they just arent providing the tools to do it.
It boils down to ads make people money. All the apps that have ads make that developer money so they can offer their app for free in most cases.
Sent from a planet far far away.
Click to expand...
Click to collapse
Yes, I understand, but they shouldnt have all the say, that was their main argument against MS.... Guess kettle calling pot black...

cteq1 said:
Yes, I understand, but they shouldnt have all the say, that was their main argument against MS.... Guess kettle calling pot black...
Click to expand...
Click to collapse
Google has all the say in what they allow and dont allow lol its their market their rules.
Sent from my SPH-L710 using xda app-developers app

I was surprised that this was not done sooner. Google is an advertising company. Us rooted users will still be able to get the job done.

here what a friend that had to say about it he points out what dev had to say about it and he gave u links to get there apps.
i know i can not link out side links but check out androidpolice to see what developer Jared Rummler had to say.

Is the ad blocker built into ROM toolbox better than ad blocker that has drop box link in this thread?
L 710 on The Peoples ROM.

acooken said:
Is the ad blocker built into ROM toolbox better than ad blocker that has drop box link in this thread?.
Click to expand...
Click to collapse
I haven't noticed much difference. I now just use the rom toolbox pro version. Running TPR ROM.
Sent from my SPH-L710 using xda premium

[MUST READ] XDA major security flaws on protecting user information

I recently did some network checks for XDA and found out that they are not providing enough security for the personal information of members in the community.
Basically nothing is encrypted
Here is the login page:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
As you can see it's in MD5, preferably passwords must be encrypted in order to safeguard your personal information. As MD5 hashes can be reversed.
Here is the worst part, I found out that my personal messages are not encrypted and have no security measures in place. A person can easily intercept your message without any reasonable effort.
Nah, that's not the worst part, this is...
When you change your password a potential hacker can intercept both your old and new password IN PLAIN TEXT.
I as a user want my personal data on my account to be safe, XDA should implement a full HTTPS for all Private Messages and User credentials as well as password edting.

Wow, just wow. I'm actually gobsmacked
“Power brings a man many luxuries, but a clean pair of hands is seldom among them.”
― Robert Harris
---------- Post added at 11:20 AM ---------- Previous post was at 11:17 AM ----------
Erm, question Deathnotice01. What about the Google sign in?
“Power brings a man many luxuries, but a clean pair of hands is seldom among them.”
― Robert Harris

That's just sad ?
Sent from my KitKatified HTC One X

I guess it doesn't really matter if I switch to Google sign in if nothing else is secure anyway
“Power brings a man many luxuries, but a clean pair of hands is seldom among them.”
― Robert Harris

@MikeChannon @svetius
Sent from my KitKatified HTC One X

Luckily I am using my Google account to access XDA, but damn - this is a major security flaw, on not on some weirdo site buy on XDA *DEVELOPERS*

RohinZaraki said:
@MikeChannon @svetius
Sent from my KitKatified HTC One X
Click to expand...
Click to collapse
I'm not an expert on this so I've passed it to one of our systems people and Sv has a mention too I see.
Mike

deathnotice01 said:
I recently did some network checks for XDA and found out that they are not providing enough security for the personal information of members in the community.
Click to expand...
Click to collapse
Please see this thread regarding bringing HTTPS to XDA: http://forum.xda-developers.com/showthread.php?t=2383868. It has a lot of discussion about this topic.
deathnotice01 said:
Here is the worst part, I found out that my personal messages are not encrypted and have no security measures in place. A person can easily intercept your message without any reasonable effort.
When you change your password a potential hacker can intercept both your old and new password IN PLAIN TEXT.
Click to expand...
Click to collapse
In both of these situations, an attacker would have to be intercepting your traffic. I don't think that this is considered 'easily intercepted'. But, I agree we should be hashing this information on password change. This is built-in vbulletin functionality that we haven't modified but will take a look at the feasibility of changing it. Shouldn't be too difficult. (Famous last words)
deathnotice01 said:
I as a user want my personal data on my account to be safe, XDA should implement a full HTTPS for all Private Messages and User credentials as well as password edting.[/size]
Click to expand...
Click to collapse
We fully agree with this. However XDA is built on vBulletin which doesn't have great capabilities for https. Here are the two major reasons why we don't have it on XDA yet:
1. vBulletin doesn't seem to handle cross-protocol (or even https) sessions very well. You can log in fine, but the session will expire after 5 minutes on different pages. There were a lot of other vBulletin issues regarding https, and I've actually done a lot of coding to fix most of the issues, but the session issue is still outstanding.
2. XDA is filled with 3rd party content, most of which is unencrypted. This will trigger browser warnings all over the place. The only solution to this that I see is to proxy the content on our own servers with https, however this is a pretty huge endeavor.
I am all on board for doing XDA in full https mode but there are still some of these major issues we haven't worked out solutions to (yet).

Wow, really glad you found this out! I know that because of heart bleed they had to redo a lot of the https encryption, but to think that there was almost no security in which to protect our own privacy, its just mind boggling. Good (bad?) find!
Sent from my SGH-I927 using Tapatalk

In both of these situations, an attacker would have to be intercepting your traffic. I don't think that this is considered 'easily intercepted'. But, I agree we should be hashing this information on password change. This is built-in vbulletin functionality that we haven't modified but will take a look at the feasibility of changing it. Shouldn't be too difficult. (Famous last words)
Click to expand...
Click to collapse
It's really easy.
Sniff traffic of a target device and viola. It's HTTP so no decrypting required even a person without any good network auditing experience can perform this attack.
You can download tools from the internet to do such stuff with relatively low or no setup required.
We fully agree with this. However XDA is built on vBulletin which doesn't have great capabilities for https. Here are the two major reasons why we don't have it on XDA yet:
Click to expand...
Click to collapse
Remember Data breach is a big possibility.
Regardless of the system an appropriate amount of security should be implemented that would reasonably protect the transmission of personal information because you are accountable for the data you collect and/or keep.
I personally thank you for looking into it.
Wrote this S#!t via Samsung Galaxy Note 3 LTE

Just gonna bump this incase there's any updates
Sent via Moto X Developer Edition