4 ms·
Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.
by mixedbit 12y ago
Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.
- tempodox 12y agoThat was probably to prevent SQL injection, right?
- Zikes 12y agoProperly implemented parameterized SQL would allow '; drop table users; -- As a password without batting an eye.
- sp332 12y agoBut since you can't guarantee that every programmer and contractor, including future ones, write proper SQL, it's nice to reduce the attack surface a bit.
- KMag 12y agoReduce the attack surface by running the password through a proper modern Key Derivation Function (KDF) such as Scrypt before passing it to the database, not by running it through a few regexes.
- CocaKoala 12y agohey man don't post my password here. Now I gotta change it again and I'm running out of good sql queries.
- BoppreH 12y agoUnless I'm missing something here, lacking parametrization is not the issue here. The issue is that it's obvious they are saving the password in plaintext instead of hashing it, otherwise the password would never get close to an SQL query to allow injection.
- oneeyedpigeon 12y agoCan you really prevent SQL injection via a blacklist?
- dllthomas 12y agoA finite blacklist? No, I don't think so. A regex blacklist? Yes; trivially if you can be radically overly cautious.
- leetrout 12y agoCiti is the same way... Nothing in their policy about what isn't allowed[0] and they updated their system one weekend and my password quit working because it had % in it. I called tech support over it and they offered no additional guidance. https://www.accountonline.com/cards/svc/OutsideView.do?forward=IDPassGuidelines&siteId=CB https://www.accountonline.com/cards/svc/OutsideView.do?forwa...
- theg2 12y agoCiti Student Loan website maxes out at 6 or 7 characters and is utter garbage on top of that. Worst case though, someone could pay my student loans for me I guess.
- deleted 12y ago[deleted]
- ceejayoz 12y agoIn the worst possible way - it makes clear that they're vulnerable to it.