5 ms·
This is why you need to hash reset tokens too http://sakurity.com/blog/2015/03/27/slack_or_reset_token_hashing.html http://sakurity.com/blog/2015/03/27/slack_o
by homakov 12y ago
This is why you need to hash reset tokens too
http://sakurity.com/blog/2015/03/27/slack_or_reset_token_hashing.html http://sakurity.com/blog/2015/03/27/slack_or_reset_token_has...
- grey-area 12y agoIn devise at least reset tokens expire, so they'd need to have been set in the last day to be useful, which narrows that attack considerably doesn't it?
- homakov 12y agoWhy wait and not use it right away? If you have read access now you can exploit now.
- grey-area 12y agoOh I see - you mean they have read access, then trigger password reset, then use the token straight away? That does mean they'd be firing off emails which would alert users though.
- homakov 12y agoIt would. They didn't do it probably because they didn't try this trick. But they could i think.
- homakov 12y agoBTW actually new version of devise hashes tokens.