2 ms·

The second thing is to fix the password problem. They should force users to create more complex passwords when they log in. Seen from a security perspective th

by mixmax 18y ago

The second thing is to fix the password problem. They should force users to create more complex passwords when they log in. Seen from a security perspective this adds to the overall security of the site, however most users simply find an easy password that fits the bill. blink182, 123456qwerty, qwerty! - which is almost as easy to bruteforce or keep in a rainbow table as normal dictionaries. You should be aware, however, that password requirements detract from the user experience. When users pick a password for a new account they are at the most crucial part of a website: The sign-up. This is where you can lose people that were otherwise ready to sign up. So it's a trade-off. If your site holds credit card numbers, or other vital information a certain minimum requirement for passwords is certainly in place, but if your site is something like HN, where no valuable information is held, you should probably just let users pick whatever password they like. Worst case they will lose a few comments and some karma.

patio11 18y ago
Worst case they will lose a few comments and some karma. I think the worse case is actually substantially worse -- call it an identity escalation attack. I think a huge number of Internet users are vulnerable to it: a) Use any means you please to compromise the password on a low-security site, such as HN. b) Use the same login credentials at other low-security sites, such as Facebook and Twitter. These compromises are valuable in their own right, but what you are really looking for is the email address. c) After you have their email address, compromise it using variations on the same password you already know. d) You can now read their email. Search for "statement", and identify which bank they bank with. Go to bank and try logging in with their email and password. That probably just worked. If not, click "lost password", supply email address and their security question (you have their Facebook already or can in seconds, how hard will it be to find their mother's maiden name or middle school?), and enjoy. e) For added fun, look for other high-value accounts whose security is premised on the email user being authorized, such as brokerages (a tough target due to strong institutional controls, like banks) and GoDaddy (a successful compromise would cost me FAR more than what I have in my bank account). The worst part? You can automate large portions of this attack (given a list of usernames and password, writing a script to try them at a dozen or a hundred popular services is child's play) and outsource the rest right up until the "compromise bank account" portion.

by mixmax 18y ago

patio11 18y ago

Worst case they will lose a few comments and some karma. I think the worse case is actually substantially worse -- call it an identity escalation attack. I think a huge number of Internet users are vulnerable to it: a) Use any means you please to compromise the password on a low-security site, such as HN. b) Use the same login credentials at other low-security sites, such as Facebook and Twitter. These compromises are valuable in their own right, but what you are really looking for is the email address. c) After you have their email address, compromise it using variations on the same password you already know. d) You can now read their email. Search for "statement", and identify which bank they bank with. Go to bank and try logging in with their email and password. That probably just worked. If not, click "lost password", supply email address and their security question (you have their Facebook already or can in seconds, how hard will it be to find their mother's maiden name or middle school?), and enjoy. e) For added fun, look for other high-value accounts whose security is premised on the email user being authorized, such as brokerages (a tough target due to strong institutional controls, like banks) and GoDaddy (a successful compromise would cost me FAR more than what I have in my bank account). The worst part? You can automate large portions of this attack (given a list of usernames and password, writing a script to try them at a dozen or a hundred popular services is child's play) and outsource the rest right up until the "compromise bank account" portion.