8 ms·
> By that logic serial-type ids are unsafe for use too, and much more vulnerable. Yes, they are. Still, it's not good security advice to point towards an othe
by bhaak 3y ago
> By that logic serial-type ids are unsafe for use too, and much more vulnerable.
Yes, they are. Still, it's not good security advice to point towards an other thing and say "this is even worse".
- stephenr 3y agoThe point I was making is that the claimed "exploit" is completely outside the bounds of what a reasonable person would do. It's like complaining that a garden hose can be used to fill a car with carbon dioxide so we should recommend against using hoses in gardens.
- bhaak 3y agoThat's often an issue that people think attackers wouldn't got all the way because it's too cumbersome. "Reasonable" has a very imprecise definition. > On a recent Code Assisted Penetration Test (CAPT) our team identified a vulnerability in a client's web application which allowed the consultant to bypass authentication and take over legitimate user accounts. The issue stemmed from the use of UUID version 1 in password reset tokens instead of the secure version 4 counterpart. https://realizesec.com/blog/sandwich-attacks-exploiting-uuid-v1 https://realizesec.com/blog/sandwich-attacks-exploiting-uuid...
- stephenr 3y agoOk, well for this case specifically let's just assume that "reasonable" means "knows a UUIDv1 isn't random, and shouldn't be used as if it were". You can probably sub in "suitably experienced" for "reasonable" if it reads better.