Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foursquare iPhone app sends passwords in plain text, don't use

martinkou.blogspot.com

Post reply on HN
Print view View original

21–30 of 59 posts

Re: Foursquare iPhone app sends passwords in plain text, don't use

#21

Post by [deleted] »

pmjordan wrote: post #19
bitanarch wrote: post #17

Earlier quoted context omitted.

The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account. The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it. There're also services that are a lot more careful than that. e.g. Facebook Conn…

My point is I fail to see how this is an unusual or new situation. You can probably accuse millions of sites of sending passwords in the clear on login. Besides: say I steal your HN (or whatever) cookie and hit logout from your account. Your auth cookie is now no longer valid, you get a login prompt. You assume it's some kind of glitch and re-login with your password, which I intercept. Is that much better?

[deleted]

Re: Foursquare iPhone app sends passwords in plain text, don't use

#22

Post by bitanarch »

pmjordan wrote: post #19
bitanarch wrote: post #17

Earlier quoted context omitted.

The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account. The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it. There're also services that are a lot more careful than that. e.g. Facebook Conn…

My point is I fail to see how this is an unusual or new situation. You can probably accuse millions of sites of sending passwords in the clear on login. Besides: say I steal your HN (or whatever) cookie and hit logout from your account. Your auth cookie is now no longer valid, you get a login prompt. You assume it's some kind of glitch and re-login with your password, which I intercept. Is that much better?

Thing is.. very few people go into random restaurants and login (and I mean, login, in which you type in your password) to sites like Hacker News or Slashdot every day. The chance of you opening a public AP in a crowded place and getting back a Hacker News password is slim to none - I'm not saying it's safe though.

Foursquare passwords, on the other hand, is something you can very easily intercept in the open - due to the way it's used, and that it sends your passwords out every time you open it without you typing anything - that's already unusual. There're surely a lot more poorly secured sites and mobile apps, but something like Foursquare's authentication scheme is a big problem for its users.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#24

Post by parenthesis »

TheEzEzz wrote: post #18

Only tangentially related: The other day I was trying to log on to a service I rarely use, and couldn't remember my password. So I started chugging through all the different passwords I use. Then I realized what a horrible idea that is . If the service wasn't benign (or if they were using plain text), I could have just let out ALL of my passwords. Really, really stupid, but I wonder how many people do this, and how e…

A similar case is typing in your email password by mistake when (trying to) log in to a site where your email address is your username.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#25

Post by TheEzEzz »

parenthesis wrote: post #24
TheEzEzz wrote: post #18

Only tangentially related: The other day I was trying to log on to a service I rarely use, and couldn't remember my password. So I started chugging through all the different passwords I use. Then I realized what a horrible idea that is . If the service wasn't benign (or if they were using plain text), I could have just let out ALL of my passwords. Really, really stupid, but I wonder how many people do this, and how e…

A similar case is typing in your email password by mistake when (trying to) log in to a site where your email address is your username.

Good point.

I've been thinking about lazy registration a lot. I'm considering implementing a service where the user will be prompted at some point to enter their email to be remembered, but making a password optional.

The service would be worthless to hackers, but I suppose griefers could still have some fun.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#26

Post by Timothee »

phjohnst wrote: post #11
bitanarch wrote: post #10

Earlier quoted context omitted.

A lot of people use the same passwords for GMail, bank, credit card, Facebook, ..., and Foursquare. So it's a big deal if you can easily collect passwords from any one of these services.

Exactly... I guess this is just another lesson that security of a network (in this case meaning all the different services we use) is only as strong as the weakest link. Certainly not going to be firing up the foursquare app for a while

Related to the "security of a network":

one of my Facebook friends got his account compromised recently and a scam email was sent to many of his contacts. I think the scammer got the FB account somehow, and found the email of my friend as well as the emails of his FB friends shown on FB (like mine…).

It made me realize that your info on Facebook is as safe as the weakest account of your Facebook friends. I'm in control of my own passwords and make sure that all my passwords are different. But I can't control my friends' password policies, which are probably very weak overall.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#27

Post by tptacek »

pmjordan wrote: post #19
bitanarch wrote: post #17

Earlier quoted context omitted.

The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account. The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it. There're also services that are a lot more careful than that. e.g. Facebook Conn…

My point is I fail to see how this is an unusual or new situation. You can probably accuse millions of sites of sending passwords in the clear on login. Besides: say I steal your HN (or whatever) cookie and hit logout from your account. Your auth cookie is now no longer valid, you get a login prompt. You assume it's some kind of glitch and re-login with your password, which I intercept. Is that much better?

It's not new. It's an old vulnerability. And no large application would survive an audit without this geting flagged.

Re: Foursquare iPhone app sends passwords in plain text, don't use

#29

Post by [deleted] »

pmjordan wrote: post #15

Unless you're reusing passwords (which of course you shouldn't be), this doesn't really seem any worse than any other unencrypted website login, or hijacking authentication cookies from an unencrypted connection. The latter you could even do with gmail until they defaulted to SSL. If you were using, say, Hacker News on a public wifi without going through a VPN or so, I could trivially log in as you just by looking at…

[deleted]

Re: Foursquare iPhone app sends passwords in plain text, don't use

#30

Post by woodrow »

kidsat wrote: post #6
tetrisgm wrote: post #2

Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

HTTP port 80 traffic from Android app: GET /v1/checkins?geolat=34.2842613&geolong=-118.2471837&geohacc=112.0 HTTP/1.1 User-Agent: com.joelapenna.foursquared:2010080500 Host: api.foursquare.com Connection: Keep-Alive Authorization: Basic dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA== HTTP port 80 traffic from iPhone app: POST /v1/checkin.json HTTP/1.1 Host: api.foursquare.com User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_…

In case this wasn't clear or you didn't read the article, 4sq is using HTTP Basic authentication:

  >>> base64.decodestring("dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==")
  'user@example.com:password'
Post reply on HN