3 ms·
The point I was making is that the claimed "exploit" is completely outside the bounds of what a reasonable person would do. It's like complaining that a garden
by stephenr 3y ago
The point I was making is that the claimed "exploit" is completely outside the bounds of what a reasonable person would do.
It's like complaining that a garden hose can be used to fill a car with carbon dioxide so we should recommend against using hoses in gardens.
- bhaak 3y agoThat's often an issue that people think attackers wouldn't got all the way because it's too cumbersome. "Reasonable" has a very imprecise definition. > On a recent Code Assisted Penetration Test (CAPT) our team identified a vulnerability in a client's web application which allowed the consultant to bypass authentication and take over legitimate user accounts. The issue stemmed from the use of UUID version 1 in password reset tokens instead of the secure version 4 counterpart. https://realizesec.com/blog/sandwich-attacks-exploiting-uuid-v1 https://realizesec.com/blog/sandwich-attacks-exploiting-uuid...
- stephenr 3y agoOk, well for this case specifically let's just assume that "reasonable" means "knows a UUIDv1 isn't random, and shouldn't be used as if it were". You can probably sub in "suitably experienced" for "reasonable" if it reads better.