Did you message them at their security disclosure email? What did they say?
Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
11–20 of 52 posts
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#12[deleted]
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#13This reads like it boils down to Stytch sends magic tokens that both authenticate and don't expire. Is that right?
And the fix is...expire properly and make the user re-auth or?
Maybe it's like this to handle when the link is opened in a different browsing session?
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#14Even more damning, looks like they got a SOC-2 Type II via Vanta in July of 2021. I just had to go through SOC-2 Type II at two startups in the last few years so I'm very familiar with the requirements. How the hell did they pass multiple penetration tests and a third party audit with such blatent security issues that an automated scan would detect? If anything, I think this says something much more damning about Van…
SOC2 is a joke and pen testers usually do a terrible job. Almost all of SOC2 has nothing to do with whether you built secure software. It seems like pen testers usually just run standard scanners, report all the false positives, and then call the job done. If your software team has been writing millions of lines of code for years, how can you expect someone to find actual security issues in something they have never seen before in just days or weeks?
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#15I've been trying to figure out options for 100% robust protection against CSRF for late 2022 (without using csrftokens in requests, which are tried and tested but are a little bit cludgy to build and use).
It's proving surprisingly difficult to research. Here are my notes so far: https://github.com/simonw/public-notes/issues/2
SameSite=Lax is almost but not quite the answer I'm looking for, for a couple of reasons:
- It doesn't protect against attacks from subdomains, since they can trigger requests that use existing Lax cookies. This is a problem because I can never be sure that a future decision won't be made to CNAME helpdesk.mysite.com over to some third party vendor who might themselves have security holes that enable XSS attacks to run against my domain
- SameSite cookie support is at 95.75% global usage. That's not 100% yet. Where security is concerned, I care about that 4.25% of users. https://caniuse.com/same-site-cookie-attribute
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#16Author links to the docs, but fails to mention if they emailed security@stytch.com - which has not only been in docs since at least late 2021, but also found doing a simple Google:
- https://stytch.com/docs/#security_overview
* Note: Search for “security@“ on link above.
- https://web.archive.org/web/20210801185042/https://stytch.co...
- https://www.google.com/search?q=stytch+security+disclosure
To me, little strange to be so critical and have obviously spent time to research and document their findings, then fail to do even basic due diligence.
Also appears author is posting this anonymously, which given the prior information, makes me wonder what their motives are. To me, this feels more like an attack than responsible disclosure. Flagging the post.
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#17Even more damning, looks like they got a SOC-2 Type II via Vanta in July of 2021. I just had to go through SOC-2 Type II at two startups in the last few years so I'm very familiar with the requirements. How the hell did they pass multiple penetration tests and a third party audit with such blatent security issues that an automated scan would detect? If anything, I think this says something much more damning about Van…
One point of clarification: Vanta doesn't do the audits. They connect you with auditors. There is no reason to think you can't buy your way into a SOC 2 cert with minimal effort.
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#18Either I'm missing something here or the login CSRF explained in the report is a very weird and not exceptional impactful vulnerability. As described the author is talking about using a CSRF attack to force someone to authenticate to a service that uses Stytch.
Regardless this is a HUGE stretch to say "has no CRSF-protection in their authentication API". You've shown one instance where they don't have CSRF protection on an endpoint that could be argued it's not necessary. Do they have CSRF protection on endpoints that let you adjust your account, perform actions in an app, or other legitimately concerning endpoints?
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#19Isn't CSRF basically dead after `SameSite=Lax` was made the default [1]? Also, magic links being valid upto certain time doesn't sound a serious vulnerability to me. If the hacker has access to person's email/browser, the game is already over. There could be valid reasons—UX-wise—for not making magic links invalidate on the first use. Ex, the user wants to login on phone with the same link. I am sorry, but the post s…
SameSite cookies don't protect against Login CSRF by default, since that attack can be triggered by a request that carries no cookies at all. I wrote a bit about that here: https://simonwillison.net/2021/Aug/3/samesite/#login-csrf-sa... Plus, SameSite cookies are only supported by 95% of worldwide browser traffic, according to https://caniuse.com/same-site-cookie-attribute If you're a vendor selling SSO services I'm…
These attacks, although theoretically possible, require a lot of assumptions. We want the user to be using an archaic browser, visitor to be user of the site we want to exploit, and visiting a the site we have exploit on.The problem is that if the company dedicated resources to fixing such small issues, which are almost guaranteed to not being exploited, the company is ignoring more important ones which have much wider surface, like an exposed internal tool.
Re: Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
#20Even more damning, looks like they got a SOC-2 Type II via Vanta in July of 2021. I just had to go through SOC-2 Type II at two startups in the last few years so I'm very familiar with the requirements. How the hell did they pass multiple penetration tests and a third party audit with such blatent security issues that an automated scan would detect? If anything, I think this says something much more damning about Van…
One point of clarification: Vanta doesn't do the audits. They connect you with auditors. There is no reason to think you can't buy your way into a SOC 2 cert with minimal effort.
Right, but Vanta is known for having a relationship with the auditors they use that is cozier than it is between SecureFrame or Drata and their auditors. This combined with the fact that they call out Vanta in their own blog post makes the whole thing even sketchier... almost like Vanta hooked them up with a rubber stamp AND almost like they don't even realize themselves that Vanta doesn't do the audit, which is CRAZY