7 ms·
There are so many gotchas in computer security. Isn't there a way to verify that a simple algorithm can have only prespecified valid final states (aka {authenti
by whatever1 6y ago
There are so many gotchas in computer security. Isn't there a way to verify that a simple algorithm can have only prespecified valid final states (aka {authenticated && allowed login}, {not authenticated && disallowed login})?
- ComputerGuru 6y agoUse a strongly (or stronger-) types language. In C++, use switch blocks instead of if statements, combined with enums (or better yet, enum class) to get exhaustibility checking (warnings at least) from the compiler. More correctly, model the entire thing as a state machine and use strong typing to prevent inadvertent or undesirable code flow changes that bypass the points of entry you are intended to use. But none of that helps here because they purposely added something that escapes the normal control flow for accessibility reasons, and instead of designing it as a part of the locked-down system, they used an escape to load the regular, unauthenticated accessibility apps for reuse.
- whatever1 6y agoBut that is the whole point, they managed to get the system to an undesireable final state {create new user}. The narrator should be part of the validation.