5 ms·

For the benefit of people not familiar with php, can someone please clarify why the author's findings reflect badly on lastpass?

by whack 10y ago

Raed667 10y ago
It just shows bad (old) coding habits that might indicate the kind of code quality running lastpass
mSparks 10y ago
Php (generally speaking) isn't "secure by design". Which means writing Php code that isn't as insecure as an ugly girl on prom night requires significant effort on the part of the developer to make applications secure. The guy notes they haven't even put in the basic effort required.
- swombat 10y ago
  > Php code that isn't as insecure as an ugly girl on prom night What the hell? Where did this come from? Could you not think of a less sexist metaphor to use here? Maybe this is how you talk to your buddies, and maybe that's fine, and maybe it's even ok to speak like this here, but in the interests of not making the tech industry even more hostile to women than it is now, my request would be to refrain from picking this particular metaphor in this particular forum.
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]
  - mSparks 10y ago
    nonesense. its only in America you cant talk about the difference between boys and girls. I dont care how much you homos, bisexuals and metrosexuals whine and moan, i am not required to respect your life choices. Sexisim isnt a bad thing, its as natural as sexual preference, whichever way you swing. https://pics.onsizzle.com/something-went-terribly-wrong-fwd-back-when-men-were-men-3812881.png https://pics.onsizzle.com/something-went-terribly-wrong-fwd-... And you know a secret? Women really do prefer men over whiney little girls. So what exactly is your beef with describing the web as insecure as an ugly girl on prom night? Its not exactly scarface high on coke. is it.
- tzs 10y ago
  What languages that are reasonably common for web development would you consider to be "secure by design"?
  - mSparks 10y ago
    start at java (the most commonly used language, making up most of google - gmail - for example) and work your way down the list, to php right at the bottom. php is fabulous for quick and cheap web dev when it doesnt matter if all your users data gets sent to haveibeenpwned.com and not much else.
ithipster 10y ago
the irony is that these findings do not say anything about the website in question. URLs are ARBITRARY strings, they have no connection to the server's internals.
DCoder 10y ago
They reflect poorly on the Lastpass website , not necessarily on their crypto. Judging from the URLs, it seems that each action is handled by a different standalone script. This is very common in legacy code bases, and it typically (not always) means that: 1) all those scripts need the same bootstrapping boilerplate copy-pasted into them, which is a maintenance nightmare. Even if you simplify it to one or two lines of boilerplate that includes a central boostrap file (or use some configuration magic to automatically run an additional script before the script you requested), it's still worse than having a single centralized entry point that handles routing, auth, and so on. There's always a chance that someone forgets or botches an auth check in one of these files and it goes unnoticed. 2) you will probably be able to make an HTTP request directly to some file that was not intended as an entry point (the author mentions header.php – this is a perfect example), and then who knows what happens, because you never planned for this and your bootstrap code doesn't run and possibly variables expected by that script are not defined, or errors thrown by the script are not handled by a pretty error handler... kinda like doing an assembler jmp into the middle of another function, after any sanity checks it might have had. 3) I have been working with PHP for 8 years now, and almost inevitably, where this pattern shows up, there's most likely outdated and insecure practices like SQL queries from string concatenation (leading to SQL injection) or unescaped HTML output (leading to XSS, XSRF, or other security problems). It's basically an "easy target" sign for hackers. Front Controller pattern [1] is a recommended alternative. [1] https://en.wikipedia.org/wiki/Front_controller https://en.wikipedia.org/wiki/Front_controller
- CiPHPerCoder 10y ago
  > 3) where there's legacy, there's most likely outdated practices like SQL queries from string concatenation or unescaped HTML output. If you combine the article's findings with this observation, one could foresee sending a crafted /footer.php?args=SQL+Injection+goes+here type request that skips past where input is "sanitized" and results in code injection. (Further details are NDA'd, but I've found similar issues before in production systems.)
  - DCoder 10y ago
    Yep, I've seen such issues in multiple systems as well.

For the benefit of people not familiar with php, can someone please clarify why the author's findings reflect badly on lastpass?

by whack 10y ago

For the benefit of people not familiar with php, can someone please clarify why the author's findings reflect badly on lastpass?

Raed667 10y ago

It just shows bad (old) coding habits that might indicate the kind of code quality running lastpass

mSparks 10y ago

Php (generally speaking) isn't "secure by design". Which means writing Php code that isn't as insecure as an ugly girl on prom night requires significant effort on the part of the developer to make applications secure. The guy notes they haven't even put in the basic effort required.

swombat 10y ago
> Php code that isn't as insecure as an ugly girl on prom night What the hell? Where did this come from? Could you not think of a less sexist metaphor to use here? Maybe this is how you talk to your buddies, and maybe that's fine, and maybe it's even ok to speak like this here, but in the interests of not making the tech industry even more hostile to women than it is now, my request would be to refrain from picking this particular metaphor in this particular forum.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
- mSparks 10y ago
  nonesense. its only in America you cant talk about the difference between boys and girls. I dont care how much you homos, bisexuals and metrosexuals whine and moan, i am not required to respect your life choices. Sexisim isnt a bad thing, its as natural as sexual preference, whichever way you swing. https://pics.onsizzle.com/something-went-terribly-wrong-fwd-back-when-men-were-men-3812881.png https://pics.onsizzle.com/something-went-terribly-wrong-fwd-... And you know a secret? Women really do prefer men over whiney little girls. So what exactly is your beef with describing the web as insecure as an ugly girl on prom night? Its not exactly scarface high on coke. is it.
tzs 10y ago
What languages that are reasonably common for web development would you consider to be "secure by design"?
- mSparks 10y ago
  start at java (the most commonly used language, making up most of google - gmail - for example) and work your way down the list, to php right at the bottom. php is fabulous for quick and cheap web dev when it doesnt matter if all your users data gets sent to haveibeenpwned.com and not much else.

ithipster 10y ago

the irony is that these findings do not say anything about the website in question. URLs are ARBITRARY strings, they have no connection to the server's internals.

DCoder 10y ago

They reflect poorly on the Lastpass website , not necessarily on their crypto. Judging from the URLs, it seems that each action is handled by a different standalone script. This is very common in legacy code bases, and it typically (not always) means that: 1) all those scripts need the same bootstrapping boilerplate copy-pasted into them, which is a maintenance nightmare. Even if you simplify it to one or two lines of boilerplate that includes a central boostrap file (or use some configuration magic to automatically run an additional script before the script you requested), it's still worse than having a single centralized entry point that handles routing, auth, and so on. There's always a chance that someone forgets or botches an auth check in one of these files and it goes unnoticed. 2) you will probably be able to make an HTTP request directly to some file that was not intended as an entry point (the author mentions header.php – this is a perfect example), and then who knows what happens, because you never planned for this and your bootstrap code doesn't run and possibly variables expected by that script are not defined, or errors thrown by the script are not handled by a pretty error handler... kinda like doing an assembler jmp into the middle of another function, after any sanity checks it might have had. 3) I have been working with PHP for 8 years now, and almost inevitably, where this pattern shows up, there's most likely outdated and insecure practices like SQL queries from string concatenation (leading to SQL injection) or unescaped HTML output (leading to XSS, XSRF, or other security problems). It's basically an "easy target" sign for hackers. Front Controller pattern [1] is a recommended alternative. [1] https://en.wikipedia.org/wiki/Front_controller https://en.wikipedia.org/wiki/Front_controller

CiPHPerCoder 10y ago
> 3) where there's legacy, there's most likely outdated practices like SQL queries from string concatenation or unescaped HTML output. If you combine the article's findings with this observation, one could foresee sending a crafted /footer.php?args=SQL+Injection+goes+here type request that skips past where input is "sanitized" and results in code injection. (Further details are NDA'd, but I've found similar issues before in production systems.)
- DCoder 10y ago
  Yep, I've seen such issues in multiple systems as well.