4 ms·

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100

by aidos 11y ago

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.

jlgaddis 11y ago
Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.). The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets to decide how he wants to handle things. [0]: https://news.ycombinator.com/item?id=11206955 https://news.ycombinator.com/item?id=11206955
- matthewmacleod 11y ago
  Maybe I'm not understanding fully how this works, but couldn't any user with administrative access already gain access to this information anyway? It's obviously got to be stored unencrypted in the browser's memory, regardless of how it gets there; I'm not sure what the difference is here.
  - jlgaddis 11y ago
    They could, sure, but this lowers the bar, I think. It's a helluva lot easier to simply fire up a packet capture for a few minutes and grab the credentials from that than to go sifting through all the gigabytes of RAM for the credentials.
- cortesoft 11y ago
  I don't think you even need administrator access to the machine. The ports being listened to aren't protected ones, and the process is running as the regular user. Any process running as that user could kill the other process and bind to those ports.
- isleyaardvark 11y ago
  That sounds like a "It rather involved being on the other side of this airtight hatchway" problem. https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=31283 https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...
draw_down 11y ago
I don't get it. Half of these comments are "this is stupid and impossible to exploit", half are calling this irresponsible disclosure.
- elliottcarlson 11y ago
  They are not related in any way. Responsible disclosure does not mean that what is being disclosed is a real threat or not.

by aidos 11y ago

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.

jlgaddis 11y ago

Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.). The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets to decide how he wants to handle things. [0]: https://news.ycombinator.com/item?id=11206955 https://news.ycombinator.com/item?id=11206955

matthewmacleod 11y ago
Maybe I'm not understanding fully how this works, but couldn't any user with administrative access already gain access to this information anyway? It's obviously got to be stored unencrypted in the browser's memory, regardless of how it gets there; I'm not sure what the difference is here.
- jlgaddis 11y ago
  They could, sure, but this lowers the bar, I think. It's a helluva lot easier to simply fire up a packet capture for a few minutes and grab the credentials from that than to go sifting through all the gigabytes of RAM for the credentials.
cortesoft 11y ago
I don't think you even need administrator access to the machine. The ports being listened to aren't protected ones, and the process is running as the regular user. Any process running as that user could kill the other process and bind to those ports.
isleyaardvark 11y ago
That sounds like a "It rather involved being on the other side of this airtight hatchway" problem. https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=31283 https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...

draw_down 11y ago

I don't get it. Half of these comments are "this is stupid and impossible to exploit", half are calling this irresponsible disclosure.

elliottcarlson 11y ago
They are not related in any way. Responsible disclosure does not mean that what is being disclosed is a real threat or not.