4 ms·

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security f

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

perardi 6y ago
Yeah, in this particular case, they were just glaringly stupid. Just gaming out ideas in my head. I have friends from rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance, and I’m just thinking of better ways to structure a system.
- thaumasiotes 6y ago
  > rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance ...what?
ghostbrainalpha 6y ago
Could you explain why that's bad for someone who knows nothing about security? Where should the password reset token be?
- dewey 6y ago
  In an email sent to the address linked to the account.
- Jtsummers 6y ago
  It should’ve been sent via email to the registered email address. That lets the account owner reject it (I didn’t request a password reset!) or use it.
- sebmellen 6y ago
  The token should only be accessible to the user requesting the password reset, meaning that it would be sent via email (this is the standard password reset flow). The flaw here is that anyone, even if they did not control the email of the user, could reset the password, because the reset token was returned in the browser, where anyone could see it. Essentially, just by knowing someone's email (not having control over it), you could reset their password.
  - ghostbrainalpha 6y ago
    You did a really great job breaking that down! Thank you!
brundolf 6y ago
The most appalling part is that this was a dedicated endpoint, named "password-reset". This wasn't some negligent leak, some misconfigured logger. It was done this way on purpose. Somebody thought this was a good idea. And nobody else saw it and thought to question it! It reveals gross institutional incompetence that probably should have been filtered out at the hiring stage.

perardi 6y ago

Yeah, in this particular case, they were just glaringly stupid. Just gaming out ideas in my head. I have friends from rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance, and I’m just thinking of better ways to structure a system.

thaumasiotes 6y ago
> rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance ...what?

ghostbrainalpha 6y ago

Could you explain why that's bad for someone who knows nothing about security? Where should the password reset token be?

dewey 6y ago
In an email sent to the address linked to the account.
Jtsummers 6y ago
It should’ve been sent via email to the registered email address. That lets the account owner reject it (I didn’t request a password reset!) or use it.
sebmellen 6y ago
The token should only be accessible to the user requesting the password reset, meaning that it would be sent via email (this is the standard password reset flow). The flaw here is that anyone, even if they did not control the email of the user, could reset the password, because the reset token was returned in the browser, where anyone could see it. Essentially, just by knowing someone's email (not having control over it), you could reset their password.
- ghostbrainalpha 6y ago
  You did a really great job breaking that down! Thank you!

brundolf 6y ago

The most appalling part is that this was a dedicated endpoint, named "password-reset". This wasn't some negligent leak, some misconfigured logger. It was done this way on purpose. Somebody thought this was a good idea. And nobody else saw it and thought to question it! It reveals gross institutional incompetence that probably should have been filtered out at the hiring stage.