8 ms·

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Pass

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project management it was actively hurting our security, and was told the the point here was to fulfill a regulatory requirement to complete and resolve all issues from a independent "pentest" not to improve security.

shp0ngle 5y ago
Ahhhh, so that's why banks specifically often don't allow automatic filling/pasting. It's because it's in some dumb regulatory pentest manual or something. OK.
- timw4mail 5y ago
  I think PCI standards are pointing to some of this nonsensical advice.
jwr 5y ago
In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".
- vunuxodo 5y ago
  Taken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.
  - jolux 5y ago
    > Oh, and that password? Not case sensitive. What, you expect them to make a case-sensitive version of NTFS just to store your password??
    - emodendroket 5y ago
      NTFS is case-sensitive.
      - Agent766 5y ago
        They made a case-insensitive version of NTFS just to store your password
      - jolux 5y ago
        I think it’s internally case sensitive and provides case insensitive APIs to users, right?
        Barracoon 5y ago
        Right, win32 is insensitive
      - bradknowles 5y ago
        It is case-preserving, but not case-sensitive. So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case. The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.
        nathell 5y ago
        APFS still defaults to case-preserving: [nathell@macmini /tmp]$ echo first > A [nathell@macmini /tmp]$ echo second > a [nathell@macmini /tmp]$ cat A second
        emodendroket 5y ago
- gnud 5y ago
  Nice read! Specifically, under 10.1: > Offer the option to display text during entry, as masked text entry is error-prone. And under 10.2.1: > Support copy and paste functionality in fields for entering memorized secrets, including passphrases. (... snip ...) > Allow at least 64 characters in length to support the use of passphrases. Encourage users to make memorized secrets as lengthy as they want, using any characters they like (including spaces), thus aiding memorization. Do not impose other composition rules (e.g. mixtures of different character types) on memorized secrets. Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise. (See Section 5.1.1 for additional information).
- juped 5y ago
  Yes, the authors of that document did an great public service in letting us point to an "official government standard".
_wldu 5y ago
This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. They don't care about real-world security, they offer insurance to cover the losses. But many insurers are no longer paying due to the volume of incidents and the lack of sound security. The auditors are typically 10 to 15 years behind technical security expertise.
- cjonas 5y ago
  This is spot on... I wish I could share my recent experience
- Wowfunhappy 5y ago
  > This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. If I can play devil's advocate for a moment—isn't this just how insurance necessarily works? Your car insurance company isn't going to interview your teenage son; they don't care that he's a particularly mindful individual, who never speeds because he remembers the time a close friend died in a car crash. "The policy says 17-year-olds are high risk, pay us a zillion bucks a month." Of course, guidelines that have literally zero value still have zero value. But they have to come up with something concrete...
  - Vrondi 5y ago
    Bad example. They aren't going to interview your son, but _most_ will take his high GPA and certificate of completion of Driver's Education class, and give you a discount for it, which is the next best thing without spending the time to interview him.
    - Wowfunhappy 5y ago
      But isn't that driver's education class certificate basically a “checkbox”? I don’t think it’s so different from those IT certifications.
      - fuzzer37 5y ago
airza 5y ago
It's a problem, to put it mildly. There is humongous growth in this space and not enough skilled people to fill the gap. I'm lucky that my current employer is more discerning but i frequently get reports from previous assessment that are just the results of uninterpreted automatic tooling :(
deergomoo 5y ago
I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript and CSS files. Not the original source files mind you, nor is directory indexing enabled or anything like that. They pointed to our compiled and minified app.js and app.css, and suggested we block access to these files as the source code to the app is “sensitive information”. Having to tell a client another company they’ve hired are absolute clowns, without making it seem like we’re trying to save our own skin, is certainly interesting.
- sirsinsalot 5y ago
  That is dire. Almost as bad as the NCC reports we had for an old client.
- geoduck14 5y ago
  >any credentials sent over HTTPS are transmitted in plain text Hummmm. So a couple of years back, I was working on some internal tools that passed sensitive information around and I found some interesting info. Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey (e.g. from the LB to the server) In the end, the biggest thing I learned is that HTTPS is hard and it sucks.
  - Hackbraten 5y ago
    > Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.
    - 5y ago

shp0ngle 5y ago

Ahhhh, so that's why banks specifically often don't allow automatic filling/pasting. It's because it's in some dumb regulatory pentest manual or something. OK.

timw4mail 5y ago
I think PCI standards are pointing to some of this nonsensical advice.

jwr 5y ago

In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".

vunuxodo 5y ago
Taken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.
- jolux 5y ago
  > Oh, and that password? Not case sensitive. What, you expect them to make a case-sensitive version of NTFS just to store your password??
  - emodendroket 5y ago
    NTFS is case-sensitive.
    - Agent766 5y ago
      They made a case-insensitive version of NTFS just to store your password
    - jolux 5y ago
      I think it’s internally case sensitive and provides case insensitive APIs to users, right?
      - Barracoon 5y ago
        Right, win32 is insensitive
    - bradknowles 5y ago
      It is case-preserving, but not case-sensitive. So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case. The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.
      - nathell 5y ago
        APFS still defaults to case-preserving: [nathell@macmini /tmp]$ echo first > A [nathell@macmini /tmp]$ echo second > a [nathell@macmini /tmp]$ cat A second
      - emodendroket 5y ago
gnud 5y ago
Nice read! Specifically, under 10.1: > Offer the option to display text during entry, as masked text entry is error-prone. And under 10.2.1: > Support copy and paste functionality in fields for entering memorized secrets, including passphrases. (... snip ...) > Allow at least 64 characters in length to support the use of passphrases. Encourage users to make memorized secrets as lengthy as they want, using any characters they like (including spaces), thus aiding memorization. Do not impose other composition rules (e.g. mixtures of different character types) on memorized secrets. Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise. (See Section 5.1.1 for additional information).
juped 5y ago
Yes, the authors of that document did an great public service in letting us point to an "official government standard".

_wldu 5y ago

This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. They don't care about real-world security, they offer insurance to cover the losses. But many insurers are no longer paying due to the volume of incidents and the lack of sound security. The auditors are typically 10 to 15 years behind technical security expertise.

cjonas 5y ago
This is spot on... I wish I could share my recent experience
Wowfunhappy 5y ago
> This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. If I can play devil's advocate for a moment—isn't this just how insurance necessarily works? Your car insurance company isn't going to interview your teenage son; they don't care that he's a particularly mindful individual, who never speeds because he remembers the time a close friend died in a car crash. "The policy says 17-year-olds are high risk, pay us a zillion bucks a month." Of course, guidelines that have literally zero value still have zero value. But they have to come up with something concrete...
- Vrondi 5y ago
  Bad example. They aren't going to interview your son, but _most_ will take his high GPA and certificate of completion of Driver's Education class, and give you a discount for it, which is the next best thing without spending the time to interview him.
  - Wowfunhappy 5y ago
    But isn't that driver's education class certificate basically a “checkbox”? I don’t think it’s so different from those IT certifications.
    - fuzzer37 5y ago

airza 5y ago

It's a problem, to put it mildly. There is humongous growth in this space and not enough skilled people to fill the gap. I'm lucky that my current employer is more discerning but i frequently get reports from previous assessment that are just the results of uninterpreted automatic tooling :(

deergomoo 5y ago

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript and CSS files. Not the original source files mind you, nor is directory indexing enabled or anything like that. They pointed to our compiled and minified app.js and app.css, and suggested we block access to these files as the source code to the app is “sensitive information”. Having to tell a client another company they’ve hired are absolute clowns, without making it seem like we’re trying to save our own skin, is certainly interesting.

sirsinsalot 5y ago
That is dire. Almost as bad as the NCC reports we had for an old client.
geoduck14 5y ago
>any credentials sent over HTTPS are transmitted in plain text Hummmm. So a couple of years back, I was working on some internal tools that passed sensitive information around and I found some interesting info. Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey (e.g. from the LB to the server) In the end, the biggest thing I learned is that HTTPS is hard and it sucks.
- Hackbraten 5y ago
  > Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.
  - 5y ago