4 ms·
> his old employer used non-protected but difficult-to-find preview links for ticketing pages. Oh come on, I find it difficult to have sympathy for a company t
by elken 6y ago
> his old employer used non-protected but difficult-to-find preview links for ticketing pages.
Oh come on, I find it difficult to have sympathy for a company that does this.
It's a ticking time bomb, and certainly not hacking.
- emsy 6y agoWhat are passwords if not difficult to guess strings? It’s usually safer to create a link with 32 random characters than letting users come up with their own passwords such as „qwer1234“.
- paulgb 6y agoI disagree. There’s a reason why security by obscurity gets a bad rap. Browsers generally treat passwords as sacred — not saving or logging them unless the user explicitly asks. On the other hand, the URL bar gets saved to history, sent as a referrer when links are clicked (in some browsers), might be sent to an external server by the browser or extensions, etc.
- emsy 6y agoI agree with the part about an URL being less secured than a password. However, it's not security by obscurity. It's just less secure and more convenient. But the URL scheme merely grants you access to a ticket, not the whole account, so the potential damage is negligible.
- bawolff 6y ago32 random characters (192 bits of entropy if you assume base64) is a lot more than just "difficult" to find. I'm pretty sure that is not what the article meant by difficult to find pages.
- borski 6y agoSure, but in this case the attacker had inside knowledge and took it to a competitor. That, itself, is scummy, as well as criminal.
- bawolff 6y ago99% of security issues are silly and avoidable in retrospect. I don't think an insecure direct reference (assuming that's what is meant) is really all that different from most XSS, SQLi, etc