3 ms·

I fully agree with your sentiment, but the specific issues discussed here (having a maximum password length of 10, silently truncating passwords, silently repla

I fully agree with your sentiment, but the specific issues discussed here (having a maximum password length of 10, silently truncating passwords, silently replacing non-ASCII with '?', setting default passwords to 6 numbers, not rate-limiting password attempts) are not things that require a red team / blue team to figure out. They aren't things that require scanning dependencies, auditing source-code, etc. These should be as basic as not storing cleartext passwords.

FabHK 6y ago
Agreed. Yes, the state of InfoSec is bad in most companies, but with Zoom it is really abysmal. World class super bad.
dathinab 6y ago
> having a maximum password length of 10, silently truncating passwords, silently replacing non-ASCII with '?', setting default passwords to 6 numbers, not rate-limiting password attempts Most newly CS students would know better then to do this or at least would know they have to properly look this up. It's sometimes hard to believe major stupid things like this are done accidentally. (But I know very well how they happen accidentally, it starts with some bug somewhere with non-us-ASCII/to long and similar, then it's constrained "temporary" and put on a must fix list but that list never gets any priority ever, things like this are sadly supper common. As long as companies don't get legally hold responsible for negligence this won't ever go away.)
- fendy3002 6y ago
  I believe it's company / business level decision. 6 to 10 length numeric password is easy to remember. And non rate limiting enables older, non tech savvy users to have as many error as they want. But the password complexity, rate limiting and other security measurements are there for a reason, and whoever cannot learn from history are doomed to repeat it.
  - winsome 6y ago
    Rate-limiting has nothing to do with the older, non-tech savvy users. You're thinking of maximum failed attempts. Rate-limiting is about preventing bots from spamming an API call.
    - fendy3002 6y ago
      Oh correct, it's as you've said.
mac-chaffee 6y ago
I'm just imagining each of those individual issues sitting at the bottom of a Jira backlog. One thing that causes them to be prioritized where I work is that if they come up during a yearly review, you can't ship your app. Overriding that "stop-ship" order requires C-level approval. Because without a specific exploit, it might be hard to convince a PM to move those up in the backlog.
netsectoday 6y ago
I agree, if Zoom isn't capable of handling #2 or #3 on the list, then #4 is irrelevant to them. You would think that "not storing cleartext passwords" is a universal given today, but the corporate structure controlling software design today actively suppress anything that isn't a feature. It silos security responsibility to the point where nobody was probably in charge of making sure there was a coherent password policy, that it conformed to any type of standard, or that it was enforced in production against their multiple running systems. This is every company today.
uzakov 6y ago
Something that might help developers is the use of OWASP ASVS during requirements gathering stage or in general, when working on new features.

FabHK 6y ago

Agreed. Yes, the state of InfoSec is bad in most companies, but with Zoom it is really abysmal. World class super bad.

dathinab 6y ago

> having a maximum password length of 10, silently truncating passwords, silently replacing non-ASCII with '?', setting default passwords to 6 numbers, not rate-limiting password attempts Most newly CS students would know better then to do this or at least would know they have to properly look this up. It's sometimes hard to believe major stupid things like this are done accidentally. (But I know very well how they happen accidentally, it starts with some bug somewhere with non-us-ASCII/to long and similar, then it's constrained "temporary" and put on a must fix list but that list never gets any priority ever, things like this are sadly supper common. As long as companies don't get legally hold responsible for negligence this won't ever go away.)

fendy3002 6y ago
I believe it's company / business level decision. 6 to 10 length numeric password is easy to remember. And non rate limiting enables older, non tech savvy users to have as many error as they want. But the password complexity, rate limiting and other security measurements are there for a reason, and whoever cannot learn from history are doomed to repeat it.
- winsome 6y ago
  Rate-limiting has nothing to do with the older, non-tech savvy users. You're thinking of maximum failed attempts. Rate-limiting is about preventing bots from spamming an API call.
  - fendy3002 6y ago
    Oh correct, it's as you've said.

mac-chaffee 6y ago

I'm just imagining each of those individual issues sitting at the bottom of a Jira backlog. One thing that causes them to be prioritized where I work is that if they come up during a yearly review, you can't ship your app. Overriding that "stop-ship" order requires C-level approval. Because without a specific exploit, it might be hard to convince a PM to move those up in the backlog.

netsectoday 6y ago

I agree, if Zoom isn't capable of handling #2 or #3 on the list, then #4 is irrelevant to them. You would think that "not storing cleartext passwords" is a universal given today, but the corporate structure controlling software design today actively suppress anything that isn't a feature. It silos security responsibility to the point where nobody was probably in charge of making sure there was a coherent password policy, that it conformed to any type of standard, or that it was enforced in production against their multiple running systems. This is every company today.

uzakov 6y ago

Something that might help developers is the use of OWASP ASVS during requirements gathering stage or in general, when working on new features.