I reproduced it for fun with BugReplay, the site I've been working on for the past year: https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a... Checks out, password is in the GET param.
I also just signed up, would love to try this out.
Ebay posts every character a user types into the password box
201–210 of 220 posts
Re: Ebay posts every character a user types into the password box
#202Twitter also sends the password + email + name on each keypress once the user has entered at least 6 characters on it signup page. [0] [0]: https://twitter.com/signup
Ugh, I had to do this once on the sign up page at a small company I worked for about 10 years ago. Ever since then, I've been weary about beginning to fill out any forms unless I really, really want them to have the info. I still think its messed up to store user data that hasn't been submitted.
Yeah, there are shady techniques from companies offering cart abandonment solutions that do exactly that (e.g. VEInteractive). If you type in an email address and don't submit the form, they'll still send you chaser emails.
I think there are valid reasons to store incomplete form data, but I don't think it should be used for reasons the customer did not intend (e.g. receiving emails).
Re: Ebay posts every character a user types into the password box
#203Re: Ebay posts every character a user types into the password box
#204How has no-one here made the observation that the reason for this is due to true password strength checks, that use existing password distribution data that is prohibitive in size to send to the browser?
They're not doing the wrong thing, and the risk of side-channel attacks on this infrequent behaviour (i.e., not authentication) are trivial compared to the risks of high entropy passwords that are also highly reused, and are thus vulnerable to trivial brute force attempts.
Re: Ebay posts every character a user types into the password box
#205For those who didn't read TFA - it does this for the password strength checker when creating a new password, not when logging in. Honestly, I can see the challenge here. A truly robust password strength checker would use dictionaries, making it too heavy to run on the client, and for usability reasons you'd want it to check on keypress. But it would be nice at the very least if they'd send it as POSTs in the body, no…
Is a dictionary really that heavy? (Honest question.)
The (most excellent) zxcvbn password strength checking library [1] (developed by an engineer at Dropbox) is 400 kB (compressed) including dictionaries.
Re: Ebay posts every character a user types into the password box
#206> Checking the password completely on the server is OK I don't even agree with that, I think the best pratice should be to hash it on the client side before sending it to a server.
Either way, this is a password strength checker, sending just a hash to the server would be useless. Client-side password strength checker would make it functionally impossible to check dictionaries.
Sorry, as I keep saying in this thread, the excellent client-side password strength checking library zxcvbn (https://github.com/dropbox/zxcvbn) is under 400 kB compressed including dictionaries, checking against
"30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and l33t speak"
Thus, it is, as a matter of fact, quite possible to do reasonable password strength checking on the client side with a footprint that's a small fraction of many of today's ad-infested websites.
Re: Ebay posts every character a user types into the password box
#207Earlier quoted context omitted.
Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
any clientside validation can easily be bypassed using something like fiddler.
Password strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.
Re: Ebay posts every character a user types into the password box
#208The HN title seems odd. Most websites send all the characters (unless I suppose backspace is used).
Re: Ebay posts every character a user types into the password box
#209Earlier quoted context omitted.
SRP is an "Augmented PAKE" which does not require the server to ever see the plaintext password. I'm not aware of any others that are claimed to be patent-free.
Avoiding patents of other protocols seems to have been one of the goals, but then Thomas has patented SRP itself. https://www.google.com/patents/US6539479 which is set to expire in two years minus 15 days (Jul 14, 1998).
Wouldn't that be 2 years and /a month/ minus 15 days? :)
Re: Ebay posts every character a user types into the password box
#210Earlier quoted context omitted.
Is a dictionary really that heavy? (Honest question.)
The ones used by security experts are in the GB range. Obviously you could do more efficient approaches like converting characters to recognize that P@ssw0rd is just Password, but then you've increased the algorithmic complexity you're sending to the client. If you want to get super-fancy, you've got to find word boundaries and whatnot to find that MyP45512345 is really just MyPass12345. Of course, the simple brute f…
> The ones used by security experts are in the GB range.
Citation? The only multi gigabyte "dictionaries" I've seen are rainbow tables. I'm genuinely curious why you'd need multiple gigabytes when the Dictionary.com app a few years ago was no more than 200 megabytes.