4 ms·
"Those options correspond to however you’ve authenticated with the site in the past. In my case choosing “Twitter” redirects me to Twitter for the standard auth
by arkitaip 15y ago
"Those options correspond to however you’ve authenticated with the site in the past. In my case choosing “Twitter” redirects me to Twitter for the standard auth dialog, and picking “Bagcheck” displays a standard password field."
- ayers 15y agoAs wgx suggests, it does look like the auto complete shows two Sacha user accounts. I presume this is before you get "those options to choose your authentication method".
- wgx 15y agoRight, but by typing a few characters I can establish if a user has an account or not, for a subsequent attack. http://news.ycombinator.com/item?id=3059759 http://news.ycombinator.com/item?id=3059759 (top comment thread) http://news.ycombinator.com/item?id=3156841 http://news.ycombinator.com/item?id=3156841
- sgdesign 15y agoBut how is that different from Googling "site:bagcheck.com John Smith"?