4 ms·

I heard rumor back in the late `90's of an e-commerce site that stored the prices for it's products in the browser cookie. Presumably a motivated buyer could go

I heard rumor back in the late `90's of an e-commerce site that stored the prices for it's products in the browser cookie. Presumably a motivated buyer could go in and edit the cookie before checkout, although I don't know if that ever actually happened.

kstrauser 2y ago
The one I’m thinking of stored prices in the HTML form as a hidden field. It trusted the client-submitted value when deciding how much to charge you. The justification I heard for the ethics of enjoying the home-rolled discount was that it was similar to haggling. The store chose to accept the offer. Not sure I totally accepted that, but appreciated the creative thinking.
AntonyGarand 2y ago
This brings back memory: This was the case for a gold-buying website for the Runescape game in the 2000s. You could edit your cookies or other front-end facing information to change the price of items in your cart, so you could buy gold or items for much cheaper than the market rate. At some point, while the vulnerability remained, they started cancelling orders abusing this and manually checking the orders. I think you could still find some old youtube videos or threads on obscure forums with enough digging about that topic, that's how I learned of it initially. So this was a real thing!
Shocka1 2y ago
Low hanging fruit that seemed somewhat common back in the day was not verifying prices of items on the backend. So a somewhat technical user could edit the price in the html field of the item to be $10 instead of $100. Between this and everything being non https - what a time to be alive.
- knodi123 2y ago
  IIRC, an early version of myspace actually used a GET form for login. It immediately redirected, but if your browser was wide enough, and your eye was trained on the address bar and knew what to look for, you'd see the password flash by in plaintext.
  - dsauerbrun 2y ago
    why is that an issue? just in case someone is peering over your shoulder? the pw will be sent in the request body as plaintext on a post...
    - knodi123 2y ago
      > just in case someone is peering over your shoulder Yes, exactly that. That's why I highlighted the risk of someone looking in the right spot at the right time. > the pw will be sent in the request body as plaintext on a post Which is how every single login form in the world works, today, for this very reason.
rescbr 2y ago
Back in these days I've seen one learning system that stored the correct answer in the value attribute of the radio button input tag.

kstrauser 2y ago

The one I’m thinking of stored prices in the HTML form as a hidden field. It trusted the client-submitted value when deciding how much to charge you. The justification I heard for the ethics of enjoying the home-rolled discount was that it was similar to haggling. The store chose to accept the offer. Not sure I totally accepted that, but appreciated the creative thinking.

AntonyGarand 2y ago

This brings back memory: This was the case for a gold-buying website for the Runescape game in the 2000s. You could edit your cookies or other front-end facing information to change the price of items in your cart, so you could buy gold or items for much cheaper than the market rate. At some point, while the vulnerability remained, they started cancelling orders abusing this and manually checking the orders. I think you could still find some old youtube videos or threads on obscure forums with enough digging about that topic, that's how I learned of it initially. So this was a real thing!

Shocka1 2y ago

Low hanging fruit that seemed somewhat common back in the day was not verifying prices of items on the backend. So a somewhat technical user could edit the price in the html field of the item to be $10 instead of $100. Between this and everything being non https - what a time to be alive.

knodi123 2y ago
IIRC, an early version of myspace actually used a GET form for login. It immediately redirected, but if your browser was wide enough, and your eye was trained on the address bar and knew what to look for, you'd see the password flash by in plaintext.
- dsauerbrun 2y ago
  why is that an issue? just in case someone is peering over your shoulder? the pw will be sent in the request body as plaintext on a post...
  - knodi123 2y ago
    > just in case someone is peering over your shoulder Yes, exactly that. That's why I highlighted the risk of someone looking in the right spot at the right time. > the pw will be sent in the request body as plaintext on a post Which is how every single login form in the world works, today, for this very reason.

rescbr 2y ago

Back in these days I've seen one learning system that stored the correct answer in the value attribute of the radio button input tag.