4 ms·
This is mindbogglingly bad. How did they manage to introduce a dependence on unauthenticated client-side state for such a critical operation in a relatively new
by nly 13y ago
This is mindbogglingly bad. How did they manage to introduce a dependence on unauthenticated client-side state for such a critical operation in a relatively new feature?
If they weren't willing to hit the database to recall the profile_id for the reset operation, it makes me wonder whether the confirmation codes are in fact deterministic, rather than randomly generated.
- GuiA 13y agoProbably some old code that was written in haste back in the day, and that never got touched because it got the job done.
- zeckalpha 13y agoSounds like Facebook.
- wikwocket 13y agoAre you kidding? Sounds like every company everywhere.
- hobs 13y agoYuuuuup. People think FB is free of these problems because they have written some highly performant code and have a shit ton of money. Nope, money doesnt cure laziness and definitely doesnt cure "it works so why fix it".
- chrismarlow9 13y agoPretty much, it's expected when you're small for security to take a backseat to convenience. However, when you reach the point of billions of users, every line of code should be reviewed and there's no excuse for something this simple to slip by.
- prostoalex 13y agoConfirmation by SMS is not a relatively new feature.