3 ms·

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without

by t1234s 2y ago

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

duxup 2y ago
It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.
- t1234s 2y ago
  Even if it was outsourced is there zero quality control?
  - anarticle 2y ago
    Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes! The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"! Having to rearc after these terrible designs would cost more, so you can see where this is going...
  - iforgot22 2y ago
    Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
rogerhoward 2y ago
I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review. He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page. One of the first XHR rows was to an endpoint named “getKeys” The return object was the root keys for the AWS prod account. This crap is incredibly common. Maybe not that egregious, but close enough.
rasz 2y ago
>$('#securityQuestionModal').modal('show'); Iv seen a couple of industrial deployments "secured" by a modal so Im totally buying whats in the article.

by t1234s 2y ago

duxup 2y ago

It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.

t1234s 2y ago
Even if it was outsourced is there zero quality control?
- anarticle 2y ago
  Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes! The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"! Having to rearc after these terrible designs would cost more, so you can see where this is going...
- iforgot22 2y ago
  Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

rogerhoward 2y ago

I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review. He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page. One of the first XHR rows was to an endpoint named “getKeys” The return object was the root keys for the AWS prod account. This crap is incredibly common. Maybe not that egregious, but close enough.

rasz 2y ago

>$('#securityQuestionModal').modal('show'); Iv seen a couple of industrial deployments "secured" by a modal so Im totally buying whats in the article.