4 ms·

he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next d

he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...

s_henry_paulson 13y ago
I think the lesson you were supposed to learn is "responsible disclosure"
jrockway 13y ago
What was embarrassing about it? You didn't add the security hole to the software.
- harryh 13y ago
  What security hole?
valverde 13y ago
I recognize this as a possibility and I would definitely take it down if the bank requested it. On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise. Then again, corporations aren't always that understanding, which is why I would be happy to comply.
- hlieberman 13y ago
  I agree. If anything, reading this analysis would make me feel /more/ comfortable about the security of this bank's software, not less It seems that they did pretty much everything right, if a bit strangely, in some cases. TOTP and co. require a private key, just like all crypto. If you have that private key, bad things happen. This is not exactly news at 11.
MichaelGG 13y ago
He didn't "mess with other peoples work". He looked at what his computer was executing. This isn't even like poking at a webpage and telling someone it appears to not validate inputs - the code was running on his own computer. On top of that, why would you ever feel embarrassed? Perhaps if you posted something very damaging with the sole intent of harming that person, then realised they weren't responsible for the problem.

s_henry_paulson 13y ago

I think the lesson you were supposed to learn is "responsible disclosure"

jrockway 13y ago

What was embarrassing about it? You didn't add the security hole to the software.

harryh 13y ago
What security hole?

valverde 13y ago

I recognize this as a possibility and I would definitely take it down if the bank requested it. On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise. Then again, corporations aren't always that understanding, which is why I would be happy to comply.

hlieberman 13y ago
I agree. If anything, reading this analysis would make me feel /more/ comfortable about the security of this bank's software, not less It seems that they did pretty much everything right, if a bit strangely, in some cases. TOTP and co. require a private key, just like all crypto. If you have that private key, bad things happen. This is not exactly news at 11.

MichaelGG 13y ago

He didn't "mess with other peoples work". He looked at what his computer was executing. This isn't even like poking at a webpage and telling someone it appears to not validate inputs - the code was running on his own computer. On top of that, why would you ever feel embarrassed? Perhaps if you posted something very damaging with the sole intent of harming that person, then realised they weren't responsible for the problem.