171–180 of 220 posts
I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
Shame it's not mobile optimised, I'd love to check this out right now. Guess I'll have to wait until I get to my laptop
Earlier quoted context omitted.
SRP is an "Augmented PAKE" which does not require the server to ever see the plaintext password. I'm not aware of any others that are claimed to be patent-free.
Avoiding patents of other protocols seems to have been one of the goals, but then Thomas has patented SRP itself. https://www.google.com/patents/US6539479 which is set to expire in two years minus 15 days (Jul 14, 1998).
I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
One small idea: Once the network traffic starts flowing, it's difficult to switch to the Javascript tab because it's constantly flowing off the screen. Maybe make the tabs fixed in place? Or have a check mark that can make them fixed or unfixed?
Earlier quoted context omitted.
That's a very interesting interpretation of the linked papers. While timing information may make brute force attacks against the passwords easier, it is not feasible to reconstruct passwords based on the timing information exposed by Ebay. It is also worth noting that the ability to perform more efficient brute force searches doesn't really matter in the case of Ebay, as it will not make such attacks feasible over th…
Attacks only get better.
For those who didn't read TFA - it does this for the password strength checker when creating a new password, not when logging in. Honestly, I can see the challenge here. A truly robust password strength checker would use dictionaries, making it too heavy to run on the client, and for usability reasons you'd want it to check on keypress. But it would be nice at the very least if they'd send it as POSTs in the body, no…
> But it would be nice at the very least if they'd send it as POSTs in the body, not GET parameters. If the GET is being sent via XHR over SSL, how is doing a POST any more secure?
Dear eBay, Sending a request on each keyboard event to determine password strength is not only a security vulnerability, it's also poor design. APIs should primarily be used to consume external resources, not stand in for client side functionality. If providing an API for password strength is important (i.e. you want to guarantee the same behavior across clients), think of your business logic as a resource and not a…
- ebay security team
I think I already noticed that some websites used googles api to do the rating of passwords on their website but I can't recall where I saw it.
curl 'https://accounts.google.com/RatePassword' -H 'Content-Type: application/x-www-form-urlencoded' --data 'Passwd=jbcfaihrwefgbGWETZHGAESjbnajfcw24704%$§&%§!vf&Emailnotme@useless.domain=&FirstName=Hacker&LastName=News'
or another endpoint:
curl 'https://accounts.google.com/InputValidator?resource=SignUp' -H 'Content-Type: application/json' -d '{"input01":{"Input":"Passwd","Passwd":"GoogleBatteryHorseStaple","PasswdAgain":"GoogleBatteryHorseStaple","FirstName":"Hacker","LastName":"News","GmailAddress":"i-have@none.yet"},"Locale":"en"}'
I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
Awesome product. Signed up for the beta. One small idea: Once the network traffic starts flowing, it's difficult to switch to the Javascript tab because it's constantly flowing off the screen. Maybe make the tabs fixed in place? Or have a check mark that can make them fixed or unfixed?
It is a terrible way to implement bot detection but with ebay owning paypal they are on the hook for lost revenue so bot detection probably takes higher priority than other security due to the actual economic impact of bots who steal hundreds or thousands of account at a time being so bad for them