7 ms·

Short version: http://criticker.com http://criticker.com sells access to their API for apps. Any API account can retrieve a list of all users it registered on t

Short version: http://criticker.com http://criticker.com sells access to their API for apps. Any API account can retrieve a list of all users it registered on the site, then retrieve the cleartext password for each user it created. There are so many WTFs in this whole situation that it's a wonder criticker has managed to keep the website online. Which is a shame, as it looks like a really useful website.

euank 13y ago
I think you got a detail wrong. I think that the app can only access all users registered with its api key. Same for passwords. You say "all users registered on the site", the api says "Note, this can't be used to lookup just any user's password – the user must have been created by the API account."
- Mithaldu 13y ago
  Dammit, thanks, i corrected that.
- matthewmacleod 13y ago
  However, the API key for any app can be discovered with zero effort, because it's included in each request. So you can retrieve the plaintext passwords for any user who has signed up with any app using the API. Whoever created this monstrosity should be ashamed of themselves.
  - rmc 13y ago
    To reiterate: Any user of an app can look at the passwords of any user created with that app.
sauerbraten 13y ago
Correction: an API account can see all users that registered through the API with that account's key. Still, WTF!?
sauerbraten 13y ago
Correction: an API account can see all users that registered through the API with that account's key. Still, WTF!?
theboss 13y ago
I dont think you realize how common the WTFs in this situation are. If you are dealing with a reputable company, this is super super WTF. When you are looking at a small website/API someone made for fun or something....It can normally be badly broken in less than 2-3 minutes....and I'm not even that talented like some of the guys out there.
- Mithaldu 13y ago
  My day job is web developer and i sit in an IRC channel where roughly half the traffic is making fun of security issues of sites. Such a glorious combination of fuckups doesn't come about that often. I'm honestly more apalled that the passwords are in plaintext than that they expose them like that. I cannot say i am surprised though. A general amount of carelessness, undeserved self-confidence and ignorance is a given in most websites, especially when it comes to PHP.
  - theboss 13y ago
    I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance. I think the best thing is that people writing code just don't understand the internals of how a lot of web attacks work and why the best practices for security prevent them. I reported two account hijack vulnerabilities on startups this weekend and was met with ``What is CSRF?''. I think the reason for this is security people keep to themselves and work as consultants. Instead of making my own company, I can go around finding people who need what I know and get easy low-risk money. Also, there really is no place to hire a ``security person'' at a early stage startup. If a security guy DOES get hired, it's either part of an IR team, an internal pentest team, and if this is the case then there's already way too much code written to even check it for the most basic best practices (you might use some tool for static analysis but are you really going to check out the thousands of issues?) I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't.
    - Killswitch 13y ago
icebraining 13y ago
As a user, I can say it is a useful site, and the score prediction engine is very accurate, in my experience. Shame about this, it's truly a security clusterfuck.
elwell 13y ago
Due to a security breach, the Criticker APIs have been taken off-line for an unspecified amount of time. We apologize for the inconvenience. [0] - http://api.criticker.com/ http://api.criticker.com/

euank 13y ago

I think you got a detail wrong. I think that the app can only access all users registered with its api key. Same for passwords. You say "all users registered on the site", the api says "Note, this can't be used to lookup just any user's password – the user must have been created by the API account."

Mithaldu 13y ago
Dammit, thanks, i corrected that.
matthewmacleod 13y ago
However, the API key for any app can be discovered with zero effort, because it's included in each request. So you can retrieve the plaintext passwords for any user who has signed up with any app using the API. Whoever created this monstrosity should be ashamed of themselves.
- rmc 13y ago
  To reiterate: Any user of an app can look at the passwords of any user created with that app.

sauerbraten 13y ago

Correction: an API account can see all users that registered through the API with that account's key. Still, WTF!?

sauerbraten 13y ago

Correction: an API account can see all users that registered through the API with that account's key. Still, WTF!?

theboss 13y ago

I dont think you realize how common the WTFs in this situation are. If you are dealing with a reputable company, this is super super WTF. When you are looking at a small website/API someone made for fun or something....It can normally be badly broken in less than 2-3 minutes....and I'm not even that talented like some of the guys out there.

Mithaldu 13y ago
My day job is web developer and i sit in an IRC channel where roughly half the traffic is making fun of security issues of sites. Such a glorious combination of fuckups doesn't come about that often. I'm honestly more apalled that the passwords are in plaintext than that they expose them like that. I cannot say i am surprised though. A general amount of carelessness, undeserved self-confidence and ignorance is a given in most websites, especially when it comes to PHP.
- theboss 13y ago
  I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance. I think the best thing is that people writing code just don't understand the internals of how a lot of web attacks work and why the best practices for security prevent them. I reported two account hijack vulnerabilities on startups this weekend and was met with ``What is CSRF?''. I think the reason for this is security people keep to themselves and work as consultants. Instead of making my own company, I can go around finding people who need what I know and get easy low-risk money. Also, there really is no place to hire a ``security person'' at a early stage startup. If a security guy DOES get hired, it's either part of an IR team, an internal pentest team, and if this is the case then there's already way too much code written to even check it for the most basic best practices (you might use some tool for static analysis but are you really going to check out the thousands of issues?) I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't.
  - Killswitch 13y ago

icebraining 13y ago

As a user, I can say it is a useful site, and the score prediction engine is very accurate, in my experience. Shame about this, it's truly a security clusterfuck.

elwell 13y ago

Due to a security breach, the Criticker APIs have been taken off-line for an unspecified amount of time. We apologize for the inconvenience. [0] - http://api.criticker.com/ http://api.criticker.com/