4 ms·
If someone has broken ebay https they will surely be able to catch the whole password at the end.
by venomsnake 10y ago
If someone has broken ebay https they will surely be able to catch the whole password at the end.
- vanwalj 10y agoSame as every website where you can login.
- slashcrypto 10y agowhat do you mean? normally passwords are not stored in logfiles ...
- vanwalj 10y ago"Normally" ? What refrain you from logging HTTP Body ? It's the same problem as logging HTTP query string. You should consider everything you send over HTTPS public for the receiver in any way.
- besselheim 10y agoThe passwords are not necessarily being captured in logfiles, that's a huge assumption. We don't know anything about how eBay stores and manages their web server logs.
- pyre 10y agoAs others are saying, using a GET request embeds that password in the URL, which means that server logs on eBay's side will have your password in them. Server logs aren't always the most protected thing in terms of locking down systems and permission management. On the flip side, most server logs do not have POST/PUT data logged.
- jyounker 10y agoUmmm... you're assuming that eBay is using a standard web server configured in some default manner. It's far more likely that this is communication with a custom authentication server of some sort. (Where server means a very large collection of machines.)
- pyre 10y agoIt's likely that eBay's internal infrastructure has compensated for this, but it also seems like a potentially overlooked aspect of their system. Even if there are no server logs per se (unlikely), they might be sending request logging information to some sort of analytics server. Since these requests are internal, it's also possible that it's not SSL-protected meaning that people internally could eavesdrop on the requests.
- venomsnake 10y agoBut the requests were POST in the picture. Edit: They do also send GET ... that is worse.