Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Peach App Token Reuse Flaw

hakobaito.co.uk

Post reply on HN
Print view View original

1–10 of 35 posts

Re: Peach App Token Reuse Flaw

#3

Post by narsil »

While I agree that the tokens must be expired on logout, it's hard to gain access to the token via MITM because the API requests are performed over TLS [0]! This point seems glossed over in the post. You would need access to a client app directly to be able to inspect its storage or sniff the traffic yourself to determine the token being used.

Access to an unencrypted client device is usually game over for most apps' data security anyway.

[0] https://www.ssllabs.com/ssltest/analyze.html?d=v1.peachapi.c...

(OP: love the graphic design and appropriate color scheme!)

Re: Peach App Token Reuse Flaw

#4

Post by Gigablah »

narsil wrote: post #3

While I agree that the tokens must be expired on logout, it's hard to gain access to the token via MITM because the API requests are performed over TLS [0]! This point seems glossed over in the post. You would need access to a client app directly to be able to inspect its storage or sniff the traffic yourself to determine the token being used. Access to an unencrypted client device is usually game over for most apps'…

Yeah, that's important missing info. I was initially dumbfounded at the apparent lack of HTTPS.

Re: Peach App Token Reuse Flaw

#7

Post by dthakur »

narsil wrote: post #3

While I agree that the tokens must be expired on logout, it's hard to gain access to the token via MITM because the API requests are performed over TLS [0]! This point seems glossed over in the post. You would need access to a client app directly to be able to inspect its storage or sniff the traffic yourself to determine the token being used. Access to an unencrypted client device is usually game over for most apps'…

Sounds like a storm in a teacup if indeed the endpoint is served over TLS.

Re: Peach App Token Reuse Flaw

#8

Post by lyime »

Wesley, The readability of your blog is rather poor. You might want to change the default width `font-size: 2vw;` to a fixed width (Use rem or em). Current css settings are not user friendly and breaks the browser zoom.

Thanks.

Re: Peach App Token Reuse Flaw

#9

Post by Alex3917 »

narsil wrote: post #3

While I agree that the tokens must be expired on logout, it's hard to gain access to the token via MITM because the API requests are performed over TLS [0]! This point seems glossed over in the post. You would need access to a client app directly to be able to inspect its storage or sniff the traffic yourself to determine the token being used. Access to an unencrypted client device is usually game over for most apps'…

> While I agree that the tokens must be expired on logout

Is there really that much additional security over deleting tokens locally when logging out, but expiring all existing tokens (using a timestamp) on password change?

Blacklisting individual tokens requires storing them in the db and then looking them up each time a user logs in. It seems like given the app already uses TLS, the tiny security gain isn't big enough to justify the performance impact.

Post reply on HN