Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ebay posts every character a user types into the password box

slashcrypto.org

Post reply on HN
Print view View original

111–120 of 220 posts

Re: Ebay posts every character a user types into the password box

#111

Post by lukeschlather »

Someone1234 wrote: post #87
arviewer wrote: post #49

Earlier quoted context omitted.

But there is a good chance that these GET parameters are logged by the webserver. Even if these servers are very secure and strictly monitored, one bad employee can cause a lot of trouble.

Perhaps, but an employee in that position can steal credentials even without GET logs. This entire discussion is predicated on a contradictory assumption, that an employee would be corrupt enough to steal credentials from web server logs, but not corrupt enough to steal the same credentials from any other source (inc. database access). It is like letting a criminal into your home, then being concerned that they might…

GET logs end up in all sorts of places. I would not be at all surprised if anyone working at EBay could get access to them. Not to say they should have access to them, but access to the logs is different from access to the server. Log reading permissions have a rightfully lower standard than ssh/deployment permissions.

(But part of what makes it OK to have more people with access to the logs is you don't put things like username/passwords for all of your customers in the logs.)

Re: Ebay posts every character a user types into the password box

#113

Post by Phlarp »

0942v8653 wrote: post #16

There is also the possibility of timing attacks on either type of request. By the length you can tell when the HTTPS request is most likely POST /PWDStrength, and from the times that the request is initiated, you can guess at some characteristics of the password (maybe they stopped typing for a second to verify requirements after typing 7 characters; maybe they stopped after 8 because they have to move to the numpad…

Is this another point in the bucket for password managers? Harder to leak any timing related information when a browser plugin auto-fills the form...

Re: Ebay posts every character a user types into the password box

#115

Post by mschuster91 »

brown9-2 wrote: post #73
mschuster91 wrote: post #32

Earlier quoted context omitted.

Not exactly. In corp/uni environments there may very well be a SSL-stripping proxy - and it works because in a corp setting you have the fake ca cert installed by IT, and in uni you often have to accept a cert when first connecting to the uni VPN.

In this scenario the distinction between GET and POST becomes irrelevant.

No, it does not, because usually an appliance will have some sort of logging - which will usually include the URL, which in turn contains the GET parameter.

Re: Ebay posts every character a user types into the password box

#117

Post by mikeash »

hartator wrote: post #116

> Checking the password completely on the server is OK I don't even agree with that, I think the best pratice should be to hash it on the client side before sending it to a server.

I'd agree if the client in some way exists independently of the server. For example, if you have a smartphone app, then client-side hashing could be useful.

But for a web page, what's the point? The server is in full control of the JavaScript they send you. If the server is compromised, it can easily bypass the client-side hashing by sending your browser different code.

Re: Ebay posts every character a user types into the password box

#119

Post by zip1234 »

hartator wrote: post #116

> Checking the password completely on the server is OK I don't even agree with that, I think the best pratice should be to hash it on the client side before sending it to a server.

Hashing it on the client side doesn't really have any positive effect on security as the client must then know what salt is used for the hash. This is less secure than just hashing on the server as the salt and number of hash iterations is then unknown by the client (or potential attackers).

Re: Ebay posts every character a user types into the password box

#120

Post by astockwell »

hartator wrote: post #116

> Checking the password completely on the server is OK I don't even agree with that, I think the best pratice should be to hash it on the client side before sending it to a server.

With that approach you would also need to be mindful of pass-the-hash vulnerabilities.
Post reply on HN