5 ms·

Perhaps the author should serve a long and random token each time you go to the change email page, and require the API call to answer back with that token.

ejcx 10y ago
You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.
- etjossem 10y ago
  Right! I'm just pointing out that this isn't necessarily malice or negligence on the part of the author. Dead Man's Switch has some ways it could be improved, and remembering to set up a CSRF token seems to be one of them.
  - StavrosK 10y ago
    The app is written in Django, probably all the way from 0.96. I rewrote it at some point, but I must have forgotten to add the CSRF middleware on an upgrade.
    - etjossem 10y ago
      Wonderful, thanks for giving it a second (third?) look.
  - ejcx 10y ago
    I don't think I'm being pedantic when I expect security software, or software dealing with secrets, to be secure. It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
    - etjossem 10y ago
      > It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users. This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.
      - ejcx 10y ago
        I'm not some heartless security snob. This is not the first time I've seen this site, and it's been broken for at least a year (when I pointed this out last time). Because of that people SHOULD stay away.
        etjossem 10y ago
        Even if the authors of such services are highly knowledgable about security, they're going to rely on reports from hobbyist security researchers to fill in the gaps. There are major companies out there right now with dedicated infosec departments - and even they have bug bounty programs, because they know they can't catch everything. I don't imagine this service gets an enormous amount of traffic. You might be among the handful of visitors to the site who are capable of noticing the CSRF issue, and maybe even the only one to go in and look at the source. He's had an email address up on his site for a while (hi@stochastictechnologies.com). Did you report the vuln to the author when you first found it?
        throwanem 10y ago
        That's all perfectly reasonable, and I'm not without sympathy for StavrosK on this. I'm also not sanguine about the idea of using a service which is meant to handle information of such gravity as this, and which has also had an extremely well understood, trivially fixed, and enormously compromising information disclosure vulnerability go unfixed for a year or more. The reason why that situation has obtained is not interesting to me; that that situation has obtained is enormously so.

ejcx 10y ago

You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.

etjossem 10y ago
Right! I'm just pointing out that this isn't necessarily malice or negligence on the part of the author. Dead Man's Switch has some ways it could be improved, and remembering to set up a CSRF token seems to be one of them.
- StavrosK 10y ago
  The app is written in Django, probably all the way from 0.96. I rewrote it at some point, but I must have forgotten to add the CSRF middleware on an upgrade.
  - etjossem 10y ago
    Wonderful, thanks for giving it a second (third?) look.
- ejcx 10y ago
  I don't think I'm being pedantic when I expect security software, or software dealing with secrets, to be secure. It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users.
  - etjossem 10y ago
    > It's not malice but solving sensitive problems without taking security seriously can actually have really big consequences for your users. This is very true - but often the author does intend to take security seriously and they've simply overlooked something. The best approach in that scenario is just to talk to them and ask them to take a look at a vuln you've found, rather than immediately telling all their potential users to stay away.
    - ejcx 10y ago
      I'm not some heartless security snob. This is not the first time I've seen this site, and it's been broken for at least a year (when I pointed this out last time). Because of that people SHOULD stay away.
      - etjossem 10y ago
        Even if the authors of such services are highly knowledgable about security, they're going to rely on reports from hobbyist security researchers to fill in the gaps. There are major companies out there right now with dedicated infosec departments - and even they have bug bounty programs, because they know they can't catch everything. I don't imagine this service gets an enormous amount of traffic. You might be among the handful of visitors to the site who are capable of noticing the CSRF issue, and maybe even the only one to go in and look at the source. He's had an email address up on his site for a while (hi@stochastictechnologies.com). Did you report the vuln to the author when you first found it?
        throwanem 10y ago
        That's all perfectly reasonable, and I'm not without sympathy for StavrosK on this. I'm also not sanguine about the idea of using a service which is meant to handle information of such gravity as this, and which has also had an extremely well understood, trivially fixed, and enormously compromising information disclosure vulnerability go unfixed for a year or more. The reason why that situation has obtained is not interesting to me; that that situation has obtained is enormously so.