Google Chrome does this also.
Ebay posts every character a user types into the password box
191–200 of 220 posts
Re: Ebay posts every character a user types into the password box
#192Earlier quoted context omitted.
Attacks only get better.
It is, and will remain impossible to deduce a victims password from such a small timing sample. There simply isn't enough data.
I do trust you aren't an Ebay security team? ;)
Re: Ebay posts every character a user types into the password box
#193Earlier quoted context omitted.
It is, and will remain impossible to deduce a victims password from such a small timing sample. There simply isn't enough data.
I do trust you aren't an Ebay security team? ;) http://www.wired.com/2011/10/iphone-keylogger-spying/ etc.
>I do trust you aren't an Ebay security team? ;)
Luckily, not my kind of a gig.
>http://www.wired.com/2011/10/iphone-keylogger-spying/ etc.
This attack depends on being able to identify individual keys so it's not really applicable here. However, a similar attack might be possible here if not for the very small sample size.
Re: Ebay posts every character a user types into the password box
#194One that I use regularly that seems to be missing is
'set timer'. Also and amusing request from my father (who uses voice commands far more than I do): 'is there some way to print all of these out?'
Re: Ebay posts every character a user types into the password box
#195Dear eBay, Sending a request on each keyboard event to determine password strength is not only a security vulnerability, it's also poor design. APIs should primarily be used to consume external resources, not stand in for client side functionality. If providing an API for password strength is important (i.e. you want to guarantee the same behavior across clients), think of your business logic as a resource and not a…
This is a terrible idea. It would allow a client to ignore the requirements, and submit an invalid password.
Re: Ebay posts every character a user types into the password box
#196Google does the same. They regularly send your password to their server to rate it. A curl-example is provided below. I think I already noticed that some websites used googles api to do the rating of passwords on their website but I can't recall where I saw it. curl ' https://accounts.google.com/RatePassword' -H 'Content-Type: application/x-www-form-urlencoded' --data 'Passwd=jbcfaihrwefgbGWETZHGAESjbnajfcw24704%$§&%…
"Sending your password to the server" -- obviously required, that's what passwords are for.
"Sending each character of your password to the server, before you explicitly agree to submit" is quite another.
Re: Ebay posts every character a user types into the password box
#197I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
Very cool. You might be able to get some traction by using this to show some examples of common web vulnerabilities (just like this one) in the wild. I'd read a blog with those religiously. This was great.
Thanks! That's a great idea for our blog.
Re: Ebay posts every character a user types into the password box
#198Dear eBay, Sending a request on each keyboard event to determine password strength is not only a security vulnerability, it's also poor design. APIs should primarily be used to consume external resources, not stand in for client side functionality. If providing an API for password strength is important (i.e. you want to guarantee the same behavior across clients), think of your business logic as a resource and not a…
This is a terrible idea. It would allow a client to ignore the requirements, and submit an invalid password.
You have heard of server-side validation, right?
Re: Ebay posts every character a user types into the password box
#199Twitter also sends the password + email + name on each keypress once the user has entered at least 6 characters on it signup page. [0] [0]: https://twitter.com/signup
This one is interesting. Looks like they don't send any requests for username. For email address, they have a delay before sending to the server to see if it's a used email address (if you type quickly enough, it will only send a single request to validate the email).
For password, they start sending every character you type once the field has 6 characters in it. It then sends your full form details on every keypress (plus it has a delayed send to the same password_strength call, similar to what they do for emails). So if you type your password slowly, it will send your details twice for every keypress.
Re: Ebay posts every character a user types into the password box
#200Earlier quoted context omitted.
I do trust you aren't an Ebay security team? ;) http://www.wired.com/2011/10/iphone-keylogger-spying/ etc.
>I do trust you aren't an Ebay security team? ;) Luckily, not my kind of a gig. > http://www.wired.com/2011/10/iphone-keylogger-spying/ etc. This attack depends on being able to identify individual keys so it's not really applicable here. However, a similar attack might be possible here if not for the very small sample size.
It was guessing pairs of keys. But anyway.