4 ms·
WOW this was critical bug, you could basically change anyone password without authenticating and then authenticate as them. I wish heroku would disclose this i
by danielpal 14y ago
WOW this was critical bug, you could basically change anyone password without authenticating and then authenticate as them.
I wish heroku would disclose this issues.
- ssclafani 14y agoHeroku will be publishing a blog post sometime today.
- willlll 14y agohttp://blog.heroku.com/archives/2013/1/9/password_hijacking_security_incident_and_response/ http://blog.heroku.com/archives/2013/1/9/password_hijacking_...
- latchkey 14y agoI wish that Heroku would just use a third party open source auth system like Persona. This stuff is difficult and complicated to implement correctly. Sure, Persona could have had this same bug, but I'd rather trust someone who's job all day long is to implement auth systems (and which I can get the source to).