Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foursquare iPhone app sends passwords in plain text, don't use

martinkou.blogspot.com

Post reply on HN
Print view View original

11–20 of 59 posts

Re: Foursquare iPhone app sends passwords in plain text, don't use

#11

Post by phjohnst »

bitanarch wrote: post #10
jsz0 wrote: post #8

Earlier quoted context omitted.

Probably just because it's not very practical and there is no obvious payoff. You would have to sit around a popular spot for hours with a laptop sniffing the wifi to collect logins. What do you do with them? For SPAM purposes it would be easier to just make new accounts. As far as I know there's not a whole lot of valuable information in a FourSquare account like credit card numbers or banking information. Seems lik…

A lot of people use the same passwords for GMail, bank, credit card, Facebook, ..., and Foursquare. So it's a big deal if you can easily collect passwords from any one of these services.

Exactly... I guess this is just another lesson that security of a network (in this case meaning all the different services we use) is only as strong as the weakest link. Certainly not going to be firing up the foursquare app for a while

Re: Foursquare iPhone app sends passwords in plain text, don't use

#12

Post by kyro »

bitanarch wrote: post #5

Double, and triple checked. You can reproduce this yourself. I'm using a MacBook Pro for this. 1. Plug your MBP to wired ethernet - you have one of these in your home, right? 2. Open an ad-hoc network in your MBP, and share Internet access via that ad-hoc network. 3. Connect your iPhone to your MBP's ad-hoc network, now it should be able to access the Internet via your MBP. 4. Install and fire up Wireshark in your MB…

I'm doubtful. Have you quadruple checked?

Re: Foursquare iPhone app sends passwords in plain text, don't use

#13

Post by [deleted] »

kyro wrote: post #12
bitanarch wrote: post #5

Double, and triple checked. You can reproduce this yourself. I'm using a MacBook Pro for this. 1. Plug your MBP to wired ethernet - you have one of these in your home, right? 2. Open an ad-hoc network in your MBP, and share Internet access via that ad-hoc network. 3. Connect your iPhone to your MBP's ad-hoc network, now it should be able to access the Internet via your MBP. 4. Install and fire up Wireshark in your MB…

I'm doubtful. Have you quadruple checked?

[deleted]

Re: Foursquare iPhone app sends passwords in plain text, don't use

#15

Post by pmjordan »

Unless you're reusing passwords (which of course you shouldn't be), this doesn't really seem any worse than any other unencrypted website login, or hijacking authentication cookies from an unencrypted connection. The latter you could even do with gmail until they defaulted to SSL.

If you were using, say, Hacker News on a public wifi without going through a VPN or so, I could trivially log in as you just by looking at the Cookie: headers you send to it. I don't need your password to post as you and I probably could even change it because HN doesn't ask for your old password, but maybe it requires email confirmation in which case you just need to notice. Of course, HN is a similarly low-key target as 4sq for this sort of thing.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#16

Post by whakojacko »

EricButler wrote: post #4

Foursquare doesn't support SSL at all. The best you can do is request a long-lived OAuth token, but even doing that requires sending the user's email/password in plaintext (although only once!).

Yea I mentioned this on twitter to one of their engineers a several months ago and he said it was "on their to-do list." Seems a little too important for that.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#17

Post by bitanarch »

pmjordan wrote: post #15

Unless you're reusing passwords (which of course you shouldn't be), this doesn't really seem any worse than any other unencrypted website login, or hijacking authentication cookies from an unencrypted connection. The latter you could even do with gmail until they defaulted to SSL. If you were using, say, Hacker News on a public wifi without going through a VPN or so, I could trivially log in as you just by looking at…

The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account.

The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it.

There're also services that are a lot more careful than that. e.g. Facebook Connect's API uses HTTPS for (at least) the login so you can't intercept the passwords, and then it uses an HMAC-like authentication so that even if an attacker can intercept any non-encrypted messages, they can't change it or impersonate you.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#18

Post by TheEzEzz »

Only tangentially related:

The other day I was trying to log on to a service I rarely use, and couldn't remember my password. So I started chugging through all the different passwords I use. Then I realized what a horrible idea that is. If the service wasn't benign (or if they were using plain text), I could have just let out ALL of my passwords.

Really, really stupid, but I wonder how many people do this, and how effective it could be as a way to collect passwords.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#19

Post by pmjordan »

bitanarch wrote: post #17
pmjordan wrote: post #15

Unless you're reusing passwords (which of course you shouldn't be), this doesn't really seem any worse than any other unencrypted website login, or hijacking authentication cookies from an unencrypted connection. The latter you could even do with gmail until they defaulted to SSL. If you were using, say, Hacker News on a public wifi without going through a VPN or so, I could trivially log in as you just by looking at…

The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account. The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it. There're also services that are a lot more careful than that. e.g. Facebook Conn…

My point is I fail to see how this is an unusual or new situation. You can probably accuse millions of sites of sending passwords in the clear on login.

Besides: say I steal your HN (or whatever) cookie and hit logout from your account. Your auth cookie is now no longer valid, you get a login prompt. You assume it's some kind of glitch and re-login with your password, which I intercept. Is that much better?

Re: Foursquare iPhone app sends passwords in plain text, don't use

#20

Post by _cbsz »

1) Foursquare was one of the most popular targets for DEFCON'S Wall of Sheep this year, next to Twitter. I believe the mayor of the con was also made the mayor of Sheeptown.

2) Their desktop site doesn't use SSL either, as my Unencrypted Password Warning Chrome extension (https://chrome.google.com/extensions/detail/mjpinemnkjlppmem...) will warn you, so it should come as no surprise that mobile doesn't.

Post reply on HN