3 ms·
To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and type
by eranation 13y ago
To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's emails (Although they have captcha protection so it's not really feasibly or at least less likely in a reasonable cost, but still, I can find out if John Doe has a Ubisoft account or not, e.g. if I'm Joe's manager who works for a competitor, and he swore last night that he never plays Ubisoft games, busted!).
So this is what I got from their change password screen:
"No account was found matching those entries. No email will be sent."
So I'm glad I learned that I don't have my password compromised. but I think someone at Ubisoft need to take web security 101 again
p.s. Who encrypts passwords anyway? isn't there a consensus to hash using bcrypt / scrypt + random salt?
- cookiecaper 13y agoNo one encrypts passwords. They just refer to one-way hashes, typically MD5, as encryption.
- andrewmunsell 13y agoUnfortunately, I have to disagree. In fact, there are some large vendors of software that truly use encryption instead of some form of one way hashing. Sadly, I have to deal with software like this and there's no chance it's going to change any time soon.
- mattmanser 13y agoIt's a built-in feature of ASP.Net's membership provider (user accounts for those not knowing MS's Enterprise Obfuscation Naming And Extension Standard).
- recursive 13y agoBut that behavior is configurable.
- daeken 13y agoI'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue. Not in any way, shape, or form. Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), the forgot password oracle is a non-issue. You lose absolutely nothing by saying "this email does not exist", and you gain a tremendous amount of user friendliness.
- jasonlotito 13y agoI've never thought of that approach, and of course, how to go about limiting that as an attack vector. We so often try to make it as easy as possible to signup, we forget to think of it as a potential security leak. Thanks for this insight.
- xyzzyz 13y agoHow about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist: "The account have been created, but needs to be activated. Click on the link in the activation email that has been sent to your email address.". Now, the email that is actually sent says "Someone tried to create an account with your email address. If it was you, we remind you that you already have an account at our website". If the email does not exist, then usual activation email is sent. This way, we don't leak the emails of registered users. If we use emails as usernames, we don't leak usernames either.
- shabble 13y agoThis does seem like a reasonable approach, but would definitely need a rate-limiting system/opt-out to avoid intentional activate-mail DoS to the actual address owner. Might also help whoever has foo@bar.com and similar, too.
- miahi 13y agoAlso, the password is limited to 16 chars.