It'd be nice if they additionally implemented https everywhere while they're at it
Ebay posts every character a user types into the password box
181–190 of 220 posts
Re: Ebay posts every character a user types into the password box
#182Re: Ebay posts every character a user types into the password box
#183Earlier quoted context omitted.
About 162 million people.
Ouch, that's quite a bit indeed. One reason why I shop at Amazon more often.
Re: Ebay posts every character a user types into the password box
#184Earlier quoted context omitted.
This actually just sounds like a really bad implementation. Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. And then he included the email too, so the backend could look up the user and make a custom password blacklist for this specific case (eg: no personal details allowed). I actually don't disagree with doing a POST of a password to…
> Some front-end dev wasn't sure what's a good timeout to fire the password to the server on, so he or she just put it on keypress. Ebay is not a two bit software startup, it's an eCommerce powerhouse with extensive QA processes.
QA just assures that the deliverable meets the spec. It's perfectly possible to write an excellent implementation of a terrible idea.
Re: Ebay posts every character a user types into the password box
#185Earlier quoted context omitted.
If you hash, with or without salt, on the client for changing the password, you'll also need to hash identically when checking it (i.e. for login). In effect, the hash becomes the password; even if the plaintext is never leaked the first-level hash is just as good for access.
Right, but if a hacker releases a password dump for site X, no one has your password in plaintext, just the log in hash. That said, that solution requires JavaScript.
Yes, but then the attacker can ignore your JavaScript and just send the hash value they got from the dump. If you calculate hash(password) and send that for comparison to the hashed password stored in the user database, then hash(password) is your password from then on.
Re: Ebay posts every character a user types into the password box
#186Earlier quoted context omitted.
That's a very interesting interpretation of the linked papers. While timing information may make brute force attacks against the passwords easier, it is not feasible to reconstruct passwords based on the timing information exposed by Ebay. It is also worth noting that the ability to perform more efficient brute force searches doesn't really matter in the case of Ebay, as it will not make such attacks feasible over th…
Attacks only get better.
It is, and will remain impossible to deduce a victims password from such a small timing sample.
There simply isn't enough data.
Re: Ebay posts every character a user types into the password box
#187how do you know that they didn't disable logs for this url?
How do you know that they did? It's up to eBay to state that they changed to a non-default setup, not on us to assume so without asking.
Re: Ebay posts every character a user types into the password box
#188I wonder if there is any example of a large corporation taking action after a flaw is submitted via an online email form? I think those forms are sent to people who's job it is to disregard their content as much as possible.
Re: Ebay posts every character a user types into the password box
#189[deleted]
Re: Ebay posts every character a user types into the password box
#190I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
Very cool. You might be able to get some traction by using this to show some examples of common web vulnerabilities (just like this one) in the wild. I'd read a blog with those religiously. This was great.