Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ebay posts every character a user types into the password box

slashcrypto.org

Post reply on HN
Print view View original

101–110 of 220 posts

Re: Ebay posts every character a user types into the password box

#101

Post by thinkt4nk »

ryanlol wrote: post #71
wyldfire wrote: post #70

> This is not a security vulnerability itself because I think they have implemented this for some reason IMO just because the behavior is by design doesn't mean it's not a vulnerability. That said, this one seems like a grey area. I'd be worried about password information leaking by making TLS attacks easier in this mode.

This only affects a specific form that the user might interact with once a year (and that's being really optimistic), I don't really see it generating enough requests to make TLS attacks easier.

If it increases the attack surface at all, it makes it easier. Being that this site facilitates monetary transactions, I would hope they would be trying to limit their attack surface in any way possible.

I think the real point here is that there are more secure solutions. Saying that it's not all that less secure isn't a great argument.

Re: Ebay posts every character a user types into the password box

#104

Post by Splines »

rkangel wrote: post #26
wimagguc wrote: post #21

> there are some reasons behind our current solutions but I wouldn’t be able to give you more details on it. I'd be curious to know if anyone here can come up with a good enough reason for sending out the user's email & their password(-prefix) at every keystroke?

My guess is that they're doing bot detection or something similar using thing like the additional timing information and detection of typing errors.

But then what about people who rely on password autofill and password manager ctrl+v users?

Re: Ebay posts every character a user types into the password box

#105

Post by majewsky »

TorKlingberg wrote: post #94
FabHK wrote: post #93

Earlier quoted context omitted.

This might get downvoted because it's just a link, but: zxcvbn is actually a great password strength library, JavaScript, client-side, and only about 400 kB or so last time I checked (compressed, including (!) dictionaries). It was developed by a Dropbox engineer for the password setting/changing dialog at Dropbox, and open sourced, if I'm not mistaken. Again, this is a great tool, client side, small (smaller than mo…

You can do a lot of server round trips before you reach 400 kB.

Yes, but these 400 kB won't contain any personal data.

Re: Ebay posts every character a user types into the password box

#106

Post by gedrap »

reitoei wrote: post #62
parandroid wrote: post #36

Earlier quoted context omitted.

This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed). I actually don't disagree with doing a POST of a password to…

> Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. Ebay is not a two bit software startup, it's an eCommerce powerhouse with extensive QA processes.

Yeah, but being a powerhouse doesn't mean they don't introduce silly bugs. They do. E.g. on Facebook, a year or two ago, you could use dev tools and change hidden input field's value when writing a post and post to anyone's timeline (this story got tons of coverage for a bunch of reasons, vulnerability itself not being the prime one). Does it seem like a silly bug? Definitely. But it happened, it's not the first one, not the last one.

So it's a bit naive to assume devs at popular companies don't make bugs, they are superhumans, etc :)

Re: Ebay posts every character a user types into the password box

#107

Post by Torn »

reitoei wrote: post #62
parandroid wrote: post #36

Earlier quoted context omitted.

This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed). I actually don't disagree with doing a POST of a password to…

> Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. Ebay is not a two bit software startup, it's an eCommerce powerhouse with extensive QA processes.

I've seen some pretty janky pages on eBay.com, and the windows 'Turbolister' software is one of the worst things I've had the displeasure of using.

eBay is sufficiently large, and old-enough, to have substantial tech debt.

Re: Ebay posts every character a user types into the password box

#108

Post by strictnein »

reitoei wrote: post #62
parandroid wrote: post #36

Earlier quoted context omitted.

This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed). I actually don't disagree with doing a POST of a password to…

> Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. Ebay is not a two bit software startup, it's an eCommerce powerhouse with extensive QA processes.

I worked at a Fortune 100 that does billions in online sales. You'd be surprised at how often little, improper things like this can just percolate into production. And then they're defended by the people who allowed it to happen.

Re: Ebay posts every character a user types into the password box

#109

Post by [deleted] »

amalag wrote: post #92
mschuster91 wrote: post #32

Earlier quoted context omitted.

Not exactly. In corp/uni environments there may very well be a SSL-stripping proxy - and it works because in a corp setting you have the fake ca cert installed by IT, and in uni you often have to accept a cert when first connecting to the uni VPN.

If there is an inserted CA then I believe any cert from any website can be MITM'ed and there are appliances that do this. From PaloAltoNetworks website: "... firewall proxies outbound SSL connections by intercepting outbound SSL requests and generating a certificate on the fly for the site the user wants to visit."

[deleted]
Post reply on HN