4 ms·

> First of all, open redirection is not a serious vulnerability. I 100% disagree. There was a time when people didn't think XSS was a serious vulnerability to

by ebbv 10y ago

> First of all, open redirection is not a serious vulnerability. I 100% disagree. There was a time when people didn't think XSS was a serious vulnerability too. Most web developers in general are way too casual about a lot of attack vectors, and this is just one more example of that.

dsacco 10y ago
Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it. If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"? I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.
- ebbv 10y ago
  I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.
  - dsacco 10y ago
    >> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.
- Twisell 10y ago
  Thank you since 5 years now I kept myself out of Google SSO as much is I could and carefully use a bug tracker outside my favorites sites because I don't trust Google for privacy matter. Sometimes I wonder if I'm too much paranoid, but your carelessness just prove me right and I will keep NOT trusting your company.
  - deleted 10y ago
    [deleted]
  - jsmthrowaway 10y ago
    Er, who do you think works for Google here?
- dfc 10y ago
  I apoligize I don't have my copy of Garner in front of me. Why are you saying serious is only used comparatively?
tptacek 10y ago
I feel like the industry has had a long time to consider both XSS and open redirects, and has come to a pretty firm conclusion on the severity ratings for each of those classes. I'll sum it up as: "Google is not outside of the mainstream in their assessment."
- ebbv 10y ago
  Yeah, and WordPress is not outside the mainstream in their views on security either but they're wrong (which is constantly proven by how often WordPress sites get compromised.) Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.
  - tptacek 10y ago
    This is a non sequitur. Also: WordPress is far outside the mainstream of security practice; they are, and have been for coming up on a full decade, a running joke in the field. Nobody says that about Google.
    - ebbv 10y ago
      WordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream". If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass. As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.
      - tptacek 10y ago
        I feel like at this point we both understand the point I was making and don't need to litigate it further. You can and should feel free to disagree with it, but there's a reason pentesters file open redirects sev:lo. (XSS is the canonical sev:medium, for what it's worth).

by ebbv 10y ago

dsacco 10y ago

Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it. If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"? I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.

ebbv 10y ago
I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.
- dsacco 10y ago
  >> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.
Twisell 10y ago
Thank you since 5 years now I kept myself out of Google SSO as much is I could and carefully use a bug tracker outside my favorites sites because I don't trust Google for privacy matter. Sometimes I wonder if I'm too much paranoid, but your carelessness just prove me right and I will keep NOT trusting your company.
- deleted 10y ago
  [deleted]
- jsmthrowaway 10y ago
  Er, who do you think works for Google here?
dfc 10y ago
I apoligize I don't have my copy of Garner in front of me. Why are you saying serious is only used comparatively?

tptacek 10y ago

I feel like the industry has had a long time to consider both XSS and open redirects, and has come to a pretty firm conclusion on the severity ratings for each of those classes. I'll sum it up as: "Google is not outside of the mainstream in their assessment."

ebbv 10y ago
Yeah, and WordPress is not outside the mainstream in their views on security either but they're wrong (which is constantly proven by how often WordPress sites get compromised.) Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.
- tptacek 10y ago
  This is a non sequitur. Also: WordPress is far outside the mainstream of security practice; they are, and have been for coming up on a full decade, a running joke in the field. Nobody says that about Google.
  - ebbv 10y ago
    WordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream". If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass. As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.
    - tptacek 10y ago
      I feel like at this point we both understand the point I was making and don't need to litigate it further. You can and should feel free to disagree with it, but there's a reason pentesters file open redirects sev:lo. (XSS is the canonical sev:medium, for what it's worth).