What We Do in the /etc/shadow – Cryptography with Passwords
1–10 of 34 posts
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#2Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#3Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
[deleted]
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#4Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
There's a reason for this - having /etc/shadow in the title breaks searching from Algolia search due to a WAF.
eg try this
https://hn.algolia.com/?query=What%20We%20Do%20in%20the%20%2...
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#5Re: What We Do in the /etc/shadow – Cryptography with Passwords
#6Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
There's a reason for this - having /etc/shadow in the title breaks searching from Algolia search due to a WAF. eg try this https://hn.algolia.com/?query=What%20We%20Do%20in%20the%20%2...
That’s so depressing.
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#7Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
There's a reason for this - having /etc/shadow in the title breaks searching from Algolia search due to a WAF. eg try this https://hn.algolia.com/?query=What%20We%20Do%20in%20the%20%2...
That WAF needs to be tuned. If they’re worried about the possibility of a local file read that can disclose /etc/shadow, there are much bigger issues.
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#8Could someone (@dang ?) fix the title please? It is /etc/shadow , not /etc./Shadow
There's a reason for this - having /etc/shadow in the title breaks searching from Algolia search due to a WAF. eg try this https://hn.algolia.com/?query=What%20We%20Do%20in%20the%20%2...
...that's a Cloudflare security page. Is this a default setting for one of Cloudflare's security options, or did Algolia specifically add this to some edge detection worker or something? I'm curious which party is being ridiculous.
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#9Earlier quoted context omitted.
There's a reason for this - having /etc/shadow in the title breaks searching from Algolia search due to a WAF. eg try this https://hn.algolia.com/?query=What%20We%20Do%20in%20the%20%2...
...that's a Cloudflare security page. Is this a default setting for one of Cloudflare's security options, or did Algolia specifically add this to some edge detection worker or something? I'm curious which party is being ridiculous.
I just hit a website I know has an entirely default config on the free plan as https://website/q=cat /etc/shadow and got the same exact error page.
Re: What We Do in the /etc/shadow – Cryptography with Passwords
#10Earlier quoted context omitted.
...that's a Cloudflare security page. Is this a default setting for one of Cloudflare's security options, or did Algolia specifically add this to some edge detection worker or something? I'm curious which party is being ridiculous.
I just hit a website I know has an entirely default config on the free plan as https://website/q=cat /etc/shadow and got the same exact error page.
So much for CloudFlare's stance on free speech, I'm being censored for comedy!
(The title is a wordplay on What We Do in the Shadows.)
Joke aside, I can understand why, generally, protecting from /etc/shadow disclosures is a good default, but it should be possible to disable this particular protection. If anyone knows how, that'd be good to share.
EDIT: A bypass has been discovered https://infosec.exchange/@jsmall/109647469548014823