4 ms·

Went to sign up for a 'developer account'. My password: udxeik8SovTCW0qhlPMr00dBBWTW6zeAbDQ77PLIOcidhXZsEhg7yP10B4ygqkzU Rejected with: - Password must contai

by rikkus 14y ago

Went to sign up for a 'developer account'. My password: udxeik8SovTCW0qhlPMr00dBBWTW6zeAbDQ77PLIOcidhXZsEhg7yP10B4ygqkzU Rejected with: - Password must contain at least 1 special character - Password must not be longer than 15 character(s) So... ?Gc76+;%ap``h}( - Invalid Character(s) in Password Less 'special'? ... %_H$Jo#];:=?RK& - Password must contain at least 1 numeric character Here you go then: 8-8jvr£B9#UQ4Q/ - Invalid Character(s) in Password Gah. I know just know if I sign up for this, in a few months there'll be an announcement about how they've had their account details 'stolen' by 'hackers'. Not that they're incompetent or anything.

rikkus 14y ago
So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'. Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link. http://appcenter.html5tools-software.intel.com/csd/ForgotPassword.aspx?e=rik@hemsley.cc&v=EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= http://appcenter.html5tools-software.intel.com/csd/ForgotPas... That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token... EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI So does this mean I could reset anyone's password, given their email address? Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'. Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic] Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were. Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.
- facorreia 14y ago
  I just did. For your convenience, your new password is IDisposable#1.
  - rikkus 14y ago
    Thanks for that. From now on, I'm keeping my passwords in plain text on public websites and having other people set them for me.
    - hmottestad 14y ago
      This was the best discussion I've read on hackernews in a long time. So I made a screen shot and put it on my blog :) http://fluffyelephant.com/ http://fluffyelephant.com/
- caw 14y ago
  I got a different token when I tried it. pa1Wndjk+Ly3KAYrvpJghEFQUE1PQkk= It looks like it always ends in APPMOBI, but the first part can be different.
- imaffett 14y ago
  Thanks for pointing this out. We have changed token schema and validation process.

by rikkus 14y ago

rikkus 14y ago

So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'. Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link. http://appcenter.html5tools-software.intel.com/csd/ForgotPassword.aspx?e=rik@hemsley.cc&v=EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= http://appcenter.html5tools-software.intel.com/csd/ForgotPas... That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token... EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI So does this mean I could reset anyone's password, given their email address? Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'. Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic] Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were. Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.

facorreia 14y ago
I just did. For your convenience, your new password is IDisposable#1.
- rikkus 14y ago
  Thanks for that. From now on, I'm keeping my passwords in plain text on public websites and having other people set them for me.
  - hmottestad 14y ago
    This was the best discussion I've read on hackernews in a long time. So I made a screen shot and put it on my blog :) http://fluffyelephant.com/ http://fluffyelephant.com/
caw 14y ago
I got a different token when I tried it. pa1Wndjk+Ly3KAYrvpJghEFQUE1PQkk= It looks like it always ends in APPMOBI, but the first part can be different.
imaffett 14y ago
Thanks for pointing this out. We have changed token schema and validation process.