5 ms·
Other than forgot-password, why use blobs at all? Only other rare use of blobs that I can think of is proxying users from one domain to another (single sign-on,
by chime 14y ago
Other than forgot-password, why use blobs at all? Only other rare use of blobs that I can think of is proxying users from one domain to another (single sign-on, session sharing etc.)
Why would a site use blobs for reporting?
- daeken 14y agoMy theory is that the reports were really a compressed and encrypted query. Obviously that shouldn't be exposed to the user in any way (because of tampering and information leakage issues) so an encrypted blob is actually a reasonable approach when doing the handoff from one part of the site to another.
- DanBlake 14y agoI dont get why you would bother using a blob for forgot password.. Isnt something like reset.php?account=joeblow&auth=md5(accountname/secretkey/first10charsofcurrentpasshash/yymmdd) enough? You cant replay attack the reset link once its used, it expires in 24 hours and so long as the 'secretkey' was sufficiently unique, you wouldnt be able to bruteforce or crack it. All the php script needs to do is attempt to build a 'good' md5 hash and see if they match- if they do, let you input a new password to store.
- tptacek 14y agoAn attacker can do an offline brute-force attack on the "secret key" in this scheme, since attackers can be presumed to know at least one valid password in the system. Just use a random string as a primary key for a token table in a database and be done with it.
- robmil 14y agoWhy would you even use blobs for forgot-password? Is there ever a reason to use them over a single-use, time-limited token?
- finnw 14y agoMaybe to defend against a DDOS attack that fills your database with unwanted tokens