Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

451–460 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#451

Post by MarkMc »

rocqua wrote: post #416
wyldfire wrote: post #321

Stupid question department: W3c and IETF or other similar clever folks really like security stuff and do lots of clever things to make us safer. So why couldn't we create a http browser/server authentication method that has something closer to a nonce-based challenge/response mechanism? If it were standardized, the browsers could even do some clever hashing of some peer addresses or other things that we think should…

These challenge response mechanisms still require a shared secret. This means the server still needs to know either your password or a hashed version of it. TLS covers the problems a challenge-response method is supposed to solve. That is, TLS prevents replay attacks because the shared secret is sent under encryption. Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with…

> Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt.

That sounds a lot like Secure Remote Password protocol: https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

Re: Twitter urges users to change passwords after computer 'glitch'

#452

Post by larkeith »

cm2187 wrote: post #368
xamuel wrote: post #286

Earlier quoted context omitted.

Not exactly log files, but I once noticed a C coredump contained raw passwords in strings that had been free'd but not explicitly overwritten. Similar to how Facebook "deletes" files by merely marking them as deleted, "free" works the same way in C, the memory isn't actually overwritten until something else writes onto it.

But if you have access to the programs memory you have access to all the post requests anyway.

Aren't coredumps static copies of the memory state at time of termination - usually unplanned? So not really the same thing as having ongoing access to a program's memory; I can't really see a debugging process that would involve viewing memory in a dynamic way, whereas it's somewhat of a concern if coredumps (an important debugging tool) reveal plaintext passwords.

Re: Twitter urges users to change passwords after computer 'glitch'

#454

Post by Freak_NL »

tigershark wrote: post #434
Freak_NL wrote: post #397

Earlier quoted context omitted.

In Java you usually use `.equals()` to test equality, or if your argument is a boolean value: if (myVar) { // } Instead of `myVar == true/false`. The accidental assignment is much less common due to the way equality is tested in Java. Also, `null` comparisons being assigned will fail to compile (assuming var is a String here): TestApp.java:6: error: incompatible types: String cannot be converted to boolean if (var =…

But in Java it’s much easier to do the error of using == instead of equals if you always jump language.

Sure, but that is such a common mistake that all Java IDE's warn you when you try to use == for Strings and normal non-number objects.

Re: Twitter urges users to change passwords after computer 'glitch'

#455

Post by geofft »

tialaramex wrote: post #422
geofft wrote: post #192

Earlier quoted context omitted.

Client side TLS certificates get sent in the clear before you authenticate the server. (You can send them in a renegotiation, but renegotiation has been a historic source of both implementation and protocol security bugs because it does complicated things to TLS state.) So you don't want a client-side certificate that includes your name; that's a huge privacy leak. You could imagine a scheme where you give a user a c…

In TLS 1.3 client certs are sent over an encrypted link, and a reasonable client can and should wait for Finished from the server to arrive, at which point they're entirely sure of who their recipient is too. Another nice thing is that TLS 1.3 servers can send a CertificateRequest asking for a particular _type_ of certificate, so (if that's ever used in anger) it lets us have clients that don't need to waste the user…

Oh nice, that might be enough to put me back on team client certs!

Re: Twitter urges users to change passwords after computer 'glitch'

#456

Post by [deleted] »

bigiain wrote: post #245
milesokeefe wrote: post #141

Earlier quoted context omitted.

Yep, glad I read this thread. We were making the same simple mistake.

We aren't. Now. (We caught ourselves doing it 4-5 months back, and went through _everything_ checking... Only random accident that brought it to the attention of anyone who bothered to question it too... Two separate instances by different devs of 'if (DEBUG_LEVEL = 3){ }' instead of == 3 - both missed by code reviews too...)

[deleted]

Re: Twitter urges users to change passwords after computer 'glitch'

#457

Post by OldSchoolJohnny »

badloginagain wrote: post #124
jahvo wrote: post #67

Earlier quoted context omitted.

It's funny, I wonder if hearing about that github bug made them check if they had committed the same mistake... only to find that they did :-)

I think I, and everyone here, should check as well. If capable, security-minded companies can make such a mistake, so can you.

What developer in their right mind would ever log a password in the first place? Are we devolving as a profession?

Re: Twitter urges users to change passwords after computer 'glitch'

#458

Post by traviscj »

bdcs wrote: post #106
praneshp wrote: post #89

Earlier quoted context omitted.

Do you know of an elegant way to do this when working with protobufs? Ideally, mark a field 'password', and the generated class' __str__ equivalent returns " "

Check out protobuf annotations

We do this extensively. A field can be marked as "redacted", and then interceptors can do things like:

1. (most pertinent in this discussion) The logging framework can redact fields before emitting log entries. 2. Endpoints can redact the data unless the client explicitly requests (and is allowed to receive) unredacted data. 3. Serialization mechanisms (e.g. Gson) can be configured to redact data before serializing. (Again, probably can't always do this, but can make that the default for safety.)

It's also very straightforward to hook up as a Java annotation that does the same things.

Re: Twitter urges users to change passwords after computer 'glitch'

#459

Post by Michielvv »

OldSchoolJohnny wrote: post #457
badloginagain wrote: post #124

Earlier quoted context omitted.

I think I, and everyone here, should check as well. If capable, security-minded companies can make such a mistake, so can you.

What developer in their right mind would ever log a password in the first place? Are we devolving as a profession?

Can be more accidental. e.g. dumping full POST data in a more generic way (e.g. on exceptions) that happens to also be applied on the login page.

Re: Twitter urges users to change passwords after computer 'glitch'

#460

Post by oddevan »

rajathagasthya wrote: post #159
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

Is there a reason to use 1Password over iCloud Keychain if you're mostly only on Apple devices?

iCloud Keychain is definitely well-integrated, but I've run into a few edge cases where it doesn't behave the way I need it to. In these cases, 1Password is better since it actually lets me dig in and edit some of the low-level details in a quality UI (versus digging a couple levels deep in system settings/Safari preferences to find/edit the password in question).
Post reply on HN