Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ebay posts every character a user types into the password box

slashcrypto.org

Post reply on HN
Print view View original

71–80 of 220 posts

Re: Ebay posts every character a user types into the password box

#71

Post by ryanlol »

wyldfire wrote: post #70

> This is not a security vulnerability itself because I think they have implemented this for some reason IMO just because the behavior is by design doesn't mean it's not a vulnerability. That said, this one seems like a grey area. I'd be worried about password information leaking by making TLS attacks easier in this mode.

This only affects a specific form that the user might interact with once a year (and that's being really optimistic), I don't really see it generating enough requests to make TLS attacks easier.

Re: Ebay posts every character a user types into the password box

#72

Post by ncallaway »

czinck wrote: post #65
developer2 wrote: post #52

Earlier quoted context omitted.

The reason for using a server-side solution is for a password strength indicator. You need the full algorithm to run against the current entry, and every user-friendly implementation does this on every character input so you know when what you have typed is "strong enough". I'm not particularly a fan of password strength indicators in general, but if you're going to do it at least do it cleanly.

Is their algorithm so complex that it can't run in a reasonable time using client side javascript? I have trouble thinking of anything that isn't vastly over-engineered and runs slower than the network lag probably is.

No, it's more about leaking information to the JS client. If, for example, their password verification rules stipulate that you can't reuse any of your last N passwords, then they would need to make this check server-side as they don't want to provide that information to the client.

Re: Ebay posts every character a user types into the password box

#73

Post by brown9-2 »

mschuster91 wrote: post #32
brown9-2 wrote: post #20

Parameters sent via GET can get cached by proxies and they appear in log-files. Not to argue in favor of sending sensitive data via GET, but I think it is worth pointing out that third-party proxies cannot see the URL or other parts of the HTTP headers or body when the connection is using HTTPS.

Not exactly. In corp/uni environments there may very well be a SSL-stripping proxy - and it works because in a corp setting you have the fake ca cert installed by IT, and in uni you often have to accept a cert when first connecting to the uni VPN.

In this scenario the distinction between GET and POST becomes irrelevant.

Re: Ebay posts every character a user types into the password box

#74

Post by ncallaway »

lmm wrote: post #66
cmdrfred wrote: post #48

Earlier quoted context omitted.

Thanks for that. I had no idea. I wish there was a way to grab the certificate in Js. Just so you could alert the user that they are MITMed. As it stands I will have to instruct them to check manually.

If they're MITMing they could replace whatever JS you put with something else, by definition.

While this is true, a parent comment from the user you're responding to has already explicitly mentioned this as a potential issue:

"It won't stop a nation state modifying requests in transit and injecting their own js but it will probably stop a nosy sysadmin."

Re: Ebay posts every character a user types into the password box

#75

Post by czinck »

ncallaway wrote: post #72
czinck wrote: post #65

Earlier quoted context omitted.

Is their algorithm so complex that it can't run in a reasonable time using client side javascript? I have trouble thinking of anything that isn't vastly over-engineered and runs slower than the network lag probably is.

No, it's more about leaking information to the JS client. If, for example, their password verification rules stipulate that you can't reuse any of your last N passwords, then they would need to make this check server-side as they don't want to provide that information to the client.

Which sending a POST on every keystroke won't really help with anyway, because they can't tell that you typing "h-u-n" will match your old password of "hunter2", assuming it's properly hashed.

Re: Ebay posts every character a user types into the password box

#76

Post by parandroid »

reitoei wrote: post #62
parandroid wrote: post #36

Earlier quoted context omitted.

This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed). I actually don't disagree with doing a POST of a password to…

> Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. Ebay is not a two bit software startup, it's an eCommerce powerhouse with extensive QA processes.

I am well aware of that, and agree with you. There had to be some seriously bad decisions made here, and it certainly doesn't look like someone from a big company would make such mistake.

Yet, those kind of bad decisions are made every day, by people all around the world. I wouldn't give benefit of the doubt to anyone these days.

Re: Ebay posts every character a user types into the password box

#77

Post by michaelt »

czinck wrote: post #65
developer2 wrote: post #52

Earlier quoted context omitted.

The reason for using a server-side solution is for a password strength indicator. You need the full algorithm to run against the current entry, and every user-friendly implementation does this on every character input so you know when what you have typed is "strong enough". I'm not particularly a fan of password strength indicators in general, but if you're going to do it at least do it cleanly.

Is their algorithm so complex that it can't run in a reasonable time using client side javascript? I have trouble thinking of anything that isn't vastly over-engineered and runs slower than the network lag probably is.

Perhaps their algorithm isn't written in javascript?

Or perhaps they want to check the user's password choice against a multilingual dictionary, and they decided to save the user the multi-megabyte download?

Re: Ebay posts every character a user types into the password box

#78

Post by gnur »

mootothemax wrote: post #68
wimagguc wrote: post #21

> there are some reasons behind our current solutions but I wouldn’t be able to give you more details on it. I'd be curious to know if anyone here can come up with a good enough reason for sending out the user's email & their password(-prefix) at every keystroke?

>I'd be curious to know if anyone here can come up with a good enough reason for sending out the user's email & their password(-prefix) at every keystroke? I wonder if it ties into their fraud detection systems somehow. Fraudsters are lazy - so lazy that, for a good long time, you'd see the exact same few recycled photos of counterfeit items being used in item descriptions. No idea if that's changed recently. Anyway,…

I guess that fraud could be a big part of this, getting every character in sequence says way more about the end user then getting only the password in the end. I wonder how this will affect password manager users though.

Re: Ebay posts every character a user types into the password box

#79

Post by developer2 »

CannisterFlux wrote: post #17
slashcrypto wrote: post #9

Earlier quoted context omitted.

As I said in the Post, it is not a security vulnerability itself, but I want to point out that it can be very dangerous to put a password in a GET request. And the response of ebay is bad too. But thank you for your constructive comment ;)

If you're on https ebay, sending GETs to https ebay then the GET parameters are not sent in plain text. The owasp article you link to mentions that GETs can be sent in clear when you have a mixed http/https scenario. I think your screenshots are a little misleading, as not all of the headers and information you show are sent in the clear when using TLS. The response of ebay seems OK, this isn't a big issue at all. ED…

>> I guess ebay's response is a bit lacking

Except that ebay's response was to the POST over https he mentions in the first section of his article. There is absolutely nothing at all suspicious about that. He wasn't looking into a potential security hole there, he was just prodding as to why they do server-side validation in a completely secure manner. His email had nothing to do with security; he was wasting someone's time asking about implementation details.

He then went on to find a GET version in another area on the site, for which he makes no mention of having sent an email. This might not be considered a security problem to ebay depending how they manage web server logs, but it's certainly a viable inquiry compared to the POST version he did email about.

Re: Ebay posts every character a user types into the password box

#80

Post by [deleted] »

Artlav wrote: post #37
jgrahamc wrote: post #24

Earlier quoted context omitted.

Timing? Perhaps they are timing the typing speed in some way.

How common is it to have internet fast enough that a POST request completes between characters? I would expect it's completion in a second or two, enough time for a human to type about 5-15 characters, making the timing information completely meaningless.

[deleted]
Post reply on HN