4 ms·

> Starbucks could have chosen not to store the password on the phone, but users would then be forced to key in their username and password every time they wante

by ZoFreX 13y ago

> Starbucks could have chosen not to store the password on the phone, but users would then be forced to key in their username and password every time they wanted to use the app to make a purchase. These aren't the only two options. Storing a token would let users remain logged in without having the same security implications as storing the password. Some advantages of a token vs a password: 1. Lots of users use the same password on multiple sites 2. You could allow common usages via a token but still request a password re-entry for more potentially dangerous actions like changing the email address on the account 3. Tokens can be invalidated, so if the phone is lost the user can disable the app on it without needing to change their password 4. Tokens can be selectively invalidated, so if you have multiple devices you could log some of them out without logging them all out 5. Tokens can be set to expire so you can request password re-entry every so often just to ensure a bad actor would get locked out eventually

prolifically 13y ago
It's crazy to think that a developer would publish an application that would store username/password in clear text. iOS has a keychain API that would require maybe 3 hours of work to make it work/test. I'm sure Android has something similar.
- bigtunacan 13y ago
  There are tons of "developers" out there that don't know much about security or really care about it. This is especially true in the mobile space where anyone that has published a Hello World app to the app store can get a job working as a contractor. This makes me think though that there could be some good money to be made by opening every single app like this to check it's security then offering services to said company to secure their application. Of course the way the world works today; instead of taking me up on the help they would probably just contact the police.
  - prolifically 13y ago
    Well said. I think the deceiving part is the compiling/sandboxing environment phones have. New developer don't really know what's happening when they hit the 'Build & Run' so they can't understand that the key value they are storing are in plain text somewhere in the phone easily extractable.
  - larrys 13y ago
    " Of course the way the world works today; instead of taking me up on the help they would probably just contact the police." Ok so try it this way. Contact the company [1] [2] and tell them you believe there might be security holes in their app (and make reference to cases like starbucks while pointing out that even if they are ok on that there could be other issues) and offer to tell them the results of your testing (a written report) in exchange for your fee. You haven't said you found anything in particular (and you haven't), haven't specifically said you've intruded and you can get paid for a security review which if written and done correctly will give the executive hiring you cover. [1] Suggest postal letter rather than email but you could start by email I just think it will be ignored and that it's worth the stamp to get more attention. [2] I've done similar things (not with security) and it's worked pretty well.
    - wdewind 13y ago
      This sounds almost like extortion. I would not suggest doing this with security.
      - larrys 13y ago
        It's not extortion. And it's done quite frequently by home security companies whenever there is a burglary in a particular area. "You're neighbor just had a burlary and you might be vulnerable as well!" And the wording can be altered to suit one's taste or level of comfort. Of course you can blaze a large "this is a solicitation across it" but I would suggest that if you aren't willing to push the envelope with marketing you are going to not make out as well. This is based on my many years of experience doing similar things. Business involves taking and assessing risks and rewards. (Everyone's level of comfort or ability to do this differs of course). And it's not the same (nor was I suggesting) that you say to someone "hey I found a hole in your app and if you don't pay me I will publish the results of the security hole". Details matter. By the way saying to a homeowner "I saw you have a few windows at your house that appear to be broken (that would allow entry!) and I'll tell you the broken windows if you pay me $50" is not extortion. Anymore than saying "You have an outdated HVAC and for $100 I will give you a proposal on the best system to replace it with".
Almaviva 13y ago
> 1. Lots of users use the same password on multiple sites I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. If you want the convenience of the same password for multiple sites, in the real world there are going to be weak points on some of those sites and someone who can abuse any point of the chain on any site can obtain your password for all. For the rest, expecting to change my passwords if my phone is stolen is not an unreasonable thing at all. I should do this anyway, even if businesses ensure me that I don't have to. And 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.
- thirsteh 13y ago
  > I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security-conscious people often don't meet. It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."
- ZoFreX 13y ago
  Morally yes you are correct (imo). But which product are users going to go for - the one that goes the extra mile to keep them safe and help them out, or the one that doesn't give a damn about them? We have to deal with reality, not ideals, and the reality is that most people do not practice good password management. > 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period. Which is just as possible with tokens as it is with passwords. There is no reason not to use tokens.
rwl4 13y ago
This is the direction I steer all my customers these days. Then in the user's account screen I let the user see a list of their device authorizations and they can individually delete those... I really think tokens are the way to go in nearly every case.

by ZoFreX 13y ago

prolifically 13y ago

It's crazy to think that a developer would publish an application that would store username/password in clear text. iOS has a keychain API that would require maybe 3 hours of work to make it work/test. I'm sure Android has something similar.

bigtunacan 13y ago
There are tons of "developers" out there that don't know much about security or really care about it. This is especially true in the mobile space where anyone that has published a Hello World app to the app store can get a job working as a contractor. This makes me think though that there could be some good money to be made by opening every single app like this to check it's security then offering services to said company to secure their application. Of course the way the world works today; instead of taking me up on the help they would probably just contact the police.
- prolifically 13y ago
  Well said. I think the deceiving part is the compiling/sandboxing environment phones have. New developer don't really know what's happening when they hit the 'Build & Run' so they can't understand that the key value they are storing are in plain text somewhere in the phone easily extractable.
- larrys 13y ago
  " Of course the way the world works today; instead of taking me up on the help they would probably just contact the police." Ok so try it this way. Contact the company [1] [2] and tell them you believe there might be security holes in their app (and make reference to cases like starbucks while pointing out that even if they are ok on that there could be other issues) and offer to tell them the results of your testing (a written report) in exchange for your fee. You haven't said you found anything in particular (and you haven't), haven't specifically said you've intruded and you can get paid for a security review which if written and done correctly will give the executive hiring you cover. [1] Suggest postal letter rather than email but you could start by email I just think it will be ignored and that it's worth the stamp to get more attention. [2] I've done similar things (not with security) and it's worked pretty well.
  - wdewind 13y ago
    This sounds almost like extortion. I would not suggest doing this with security.
    - larrys 13y ago
      It's not extortion. And it's done quite frequently by home security companies whenever there is a burglary in a particular area. "You're neighbor just had a burlary and you might be vulnerable as well!" And the wording can be altered to suit one's taste or level of comfort. Of course you can blaze a large "this is a solicitation across it" but I would suggest that if you aren't willing to push the envelope with marketing you are going to not make out as well. This is based on my many years of experience doing similar things. Business involves taking and assessing risks and rewards. (Everyone's level of comfort or ability to do this differs of course). And it's not the same (nor was I suggesting) that you say to someone "hey I found a hole in your app and if you don't pay me I will publish the results of the security hole". Details matter. By the way saying to a homeowner "I saw you have a few windows at your house that appear to be broken (that would allow entry!) and I'll tell you the broken windows if you pay me $50" is not extortion. Anymore than saying "You have an outdated HVAC and for $100 I will give you a proposal on the best system to replace it with".

Almaviva 13y ago

> 1. Lots of users use the same password on multiple sites I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. If you want the convenience of the same password for multiple sites, in the real world there are going to be weak points on some of those sites and someone who can abuse any point of the chain on any site can obtain your password for all. For the rest, expecting to change my passwords if my phone is stolen is not an unreasonable thing at all. I should do this anyway, even if businesses ensure me that I don't have to. And 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.

thirsteh 13y ago
> I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security-conscious people often don't meet. It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."
ZoFreX 13y ago
Morally yes you are correct (imo). But which product are users going to go for - the one that goes the extra mile to keep them safe and help them out, or the one that doesn't give a damn about them? We have to deal with reality, not ideals, and the reality is that most people do not practice good password management. > 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period. Which is just as possible with tokens as it is with passwords. There is no reason not to use tokens.

rwl4 13y ago

This is the direction I steer all my customers these days. Then in the user's account screen I let the user see a list of their device authorizations and they can individually delete those... I really think tokens are the way to go in nearly every case.