3 ms·
The Bagcheck example exposes the presence of an account - that can't be best-practise for security I would have thought.
by wgx 15y ago
The Bagcheck example exposes the presence of an account - that can't be best-practise for security I would have thought.
- arkitaip 15y ago"Those options correspond to however you’ve authenticated with the site in the past. In my case choosing “Twitter” redirects me to Twitter for the standard auth dialog, and picking “Bagcheck” displays a standard password field."
- ayers 15y agoAs wgx suggests, it does look like the auto complete shows two Sacha user accounts. I presume this is before you get "those options to choose your authentication method".
- wgx 15y agoRight, but by typing a few characters I can establish if a user has an account or not, for a subsequent attack. http://news.ycombinator.com/item?id=3059759 http://news.ycombinator.com/item?id=3059759 (top comment thread) http://news.ycombinator.com/item?id=3156841 http://news.ycombinator.com/item?id=3156841
- sgdesign 15y agoBut how is that different from Googling "site:bagcheck.com John Smith"?
- judofyr 15y agoWhen you have public profiles, checking for presence of an account is pretty easy anyway.
- sgdesign 15y agoRight. You can also check for someone's profile with his name or email on Twitter (or even just Google them).
- david_a_r_kemp 15y agoNeither is neglecting to restrict the number of attempts to type the correct password.