Obama site encourages IP address forgery from donors

Will the innovations never cease? Yesterday I described several, eh, unique capabilities pioneered by the Obama campaign in the area of campaign contributions.

Among them, failure to do even basic credit-card validation; accepting untraceable prepaid credit cards; and sharing donor lists with suspect groups like ACORN. Heck, Barack's campaign wouldn't even share those lists with Hillary!

Anyhow, an anonymous tipster mentioned that checking out the source code of the Obama donation website (https://donate.barackobama.com/page/contribute/ - not hyperlinked for obvious reasons) would reveal some interesting logic. Specifically that IP addresses of the donors can be easily spoofed through a hidden field in the form. The tipster's guess was (and I concur) that the Obama campaign is recording the spoofable IP address... not the real IP address as delivered by the web server.

It's web security 101, folks. Because IP addresses usually map back to a real client network (your ISP, your company, etc.), server logs record the actual source IP address of the request. They certainly don't record anything that the client machine provides as the genuine address.

Put simply, there's no reason to include a hidden form field for IP address. It's useless, insecure and supports IP forgery. The net result is that IP addresses recorded in this manner can't truly be resolved to a real location. Genius!

Just chalk it up to yet another startling innovation from the minds of the most creative geniuses on Earth. When it comes to accepting money from all comers, that is.