8 ms·

I dont think you realize how common the WTFs in this situation are. If you are dealing with a reputable company, this is super super WTF. When you are looking

by theboss 13y ago

I dont think you realize how common the WTFs in this situation are. If you are dealing with a reputable company, this is super super WTF. When you are looking at a small website/API someone made for fun or something....It can normally be badly broken in less than 2-3 minutes....and I'm not even that talented like some of the guys out there.

Mithaldu 13y ago
My day job is web developer and i sit in an IRC channel where roughly half the traffic is making fun of security issues of sites. Such a glorious combination of fuckups doesn't come about that often. I'm honestly more apalled that the passwords are in plaintext than that they expose them like that. I cannot say i am surprised though. A general amount of carelessness, undeserved self-confidence and ignorance is a given in most websites, especially when it comes to PHP.
- theboss 13y ago
  I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance. I think the best thing is that people writing code just don't understand the internals of how a lot of web attacks work and why the best practices for security prevent them. I reported two account hijack vulnerabilities on startups this weekend and was met with ``What is CSRF?''. I think the reason for this is security people keep to themselves and work as consultants. Instead of making my own company, I can go around finding people who need what I know and get easy low-risk money. Also, there really is no place to hire a ``security person'' at a early stage startup. If a security guy DOES get hired, it's either part of an IR team, an internal pentest team, and if this is the case then there's already way too much code written to even check it for the most basic best practices (you might use some tool for static analysis but are you really going to check out the thousands of issues?) I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't.
  - Killswitch 13y ago
    > I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't. Any language is a security death-trap for those who don't know what they're doing.
  - camus2 13y ago
    @Killswitch Problem is PHP is a templating language, not a generic purpose one. Other languages use frameworks for webdevs that usually provide basic security features like auto escaping output,orms by default(so no sql strings),csrf on forms... PHP doesnt ,so it's easier to shoot yourself in the foot.
    - jimlei 13y ago
      You mean like Symfony, Laravel, etc? Frameworks that a lot of PHP developers use these days...
      - camus2 13y ago
        You dont need a framework to do PHP webdev, in every other languages,you do.That's my point, PHP IS a templating language,no Symfony,Zend or Laravel can change that. If i write "print" in Python it wont output the result back to HTTP like PHP does. Ruby or Java dont have <?ruby or <?java tags, you get my point.
        smacktoward 13y ago
        > Ruby or Java dont have <?ruby or <?java tags I dunno about Ruby, but Java certainly does: http://en.wikipedia.org/wiki/JavaServer_Pages http://en.wikipedia.org/wiki/JavaServer_Pages
        mschuster91 13y ago
        If you use them in CGI mode, you very well have a "start" tag in form of a shebang first line like #!/usr/bin/env python. Also, shellscripts and perl are considered programming languages, and these too need a shebang line. Your point is invalid.
- woah 13y ago
  What channel is that? As an app developer, it sounds useful.
  - Mithaldu 13y ago
    Find me on irc.perl.org, same name. :)
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
lbarrow 13y ago
Security is definitely hard, but security challenges are often proportional to your apps' surface area. If you just have a simple token-based API, your language probably has libraries that can get you started with a reasonably designed security story. It's the same with passwords: at this point, you shouldn't be rolling your own password management system unless you have very specific needs. For this reason, I don't think "I made it for fun" or "I made it over a weekend" is a good excuse for such broken security. For tiny new apps, it's easier to use a library that does it correctly than it is to roll your own.
corwinstephen 13y ago
Rails + Devise = answer to all these problems.

by theboss 13y ago

Mithaldu 13y ago

My day job is web developer and i sit in an IRC channel where roughly half the traffic is making fun of security issues of sites. Such a glorious combination of fuckups doesn't come about that often. I'm honestly more apalled that the passwords are in plaintext than that they expose them like that. I cannot say i am surprised though. A general amount of carelessness, undeserved self-confidence and ignorance is a given in most websites, especially when it comes to PHP.

theboss 13y ago
I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance. I think the best thing is that people writing code just don't understand the internals of how a lot of web attacks work and why the best practices for security prevent them. I reported two account hijack vulnerabilities on startups this weekend and was met with ``What is CSRF?''. I think the reason for this is security people keep to themselves and work as consultants. Instead of making my own company, I can go around finding people who need what I know and get easy low-risk money. Also, there really is no place to hire a ``security person'' at a early stage startup. If a security guy DOES get hired, it's either part of an IR team, an internal pentest team, and if this is the case then there's already way too much code written to even check it for the most basic best practices (you might use some tool for static analysis but are you really going to check out the thousands of issues?) I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't.
- Killswitch 13y ago
  > I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't. Any language is a security death-trap for those who don't know what they're doing.
- camus2 13y ago
  @Killswitch Problem is PHP is a templating language, not a generic purpose one. Other languages use frameworks for webdevs that usually provide basic security features like auto escaping output,orms by default(so no sql strings),csrf on forms... PHP doesnt ,so it's easier to shoot yourself in the foot.
  - jimlei 13y ago
    You mean like Symfony, Laravel, etc? Frameworks that a lot of PHP developers use these days...
    - camus2 13y ago
      You dont need a framework to do PHP webdev, in every other languages,you do.That's my point, PHP IS a templating language,no Symfony,Zend or Laravel can change that. If i write "print" in Python it wont output the result back to HTTP like PHP does. Ruby or Java dont have <?ruby or <?java tags, you get my point.
      - smacktoward 13y ago
        > Ruby or Java dont have <?ruby or <?java tags I dunno about Ruby, but Java certainly does: http://en.wikipedia.org/wiki/JavaServer_Pages http://en.wikipedia.org/wiki/JavaServer_Pages
      - mschuster91 13y ago
        If you use them in CGI mode, you very well have a "start" tag in form of a shebang first line like #!/usr/bin/env python. Also, shellscripts and perl are considered programming languages, and these too need a shebang line. Your point is invalid.
woah 13y ago
What channel is that? As an app developer, it sounds useful.
- Mithaldu 13y ago
  Find me on irc.perl.org, same name. :)
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]

lbarrow 13y ago

Security is definitely hard, but security challenges are often proportional to your apps' surface area. If you just have a simple token-based API, your language probably has libraries that can get you started with a reasonably designed security story. It's the same with passwords: at this point, you shouldn't be rolling your own password management system unless you have very specific needs. For this reason, I don't think "I made it for fun" or "I made it over a weekend" is a good excuse for such broken security. For tiny new apps, it's easier to use a library that does it correctly than it is to roll your own.

corwinstephen 13y ago

Rails + Devise = answer to all these problems.