Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password may not contain: select, insert, update, delete, drop

id.uni-lj.si

Post reply on HN
Print view View original

121–130 of 254 posts

Re: Password may not contain: select, insert, update, delete, drop

#121

Post by Falmarri »

dragonmost wrote: post #108
lucb1e wrote: post #64

Earlier quoted context omitted.

Not sure if serious. We need this. If you can guess someone else's password by accident, both of you need a password reset and that password needs to go on the denylist. Modern advice for strong passwords is having a length requirement and checking the input against a list of known passwords, for example using the HIBP partial hash API. (Any time you see forced expiration or complexity requirements, you're dealing wi…

The server shouldn't even be able to know that a password is being reused as it should be hashed and salted there is no situation where this would be acceptable

You can hash them without a salt and store them in a set of passwords not associated to user accounts to enforce uniqueness without having to actually know the passwords

Re: Password may not contain: select, insert, update, delete, drop

#122

Post by Falmarri »

hn_acker wrote: post #99
sevensevennine wrote: post #20

Earlier quoted context omitted.

Don't hash the password on the client. That just changes the password to the hash of the password. Parameterize the SQL on the server instead of concatenating strings.

If you're using a third-party reverse proxy, then the third party will have access to the user's password. What's the simplest way to prevent the third-party from knowing the password? Would adding an encryption layer between the user and the actual website owner be both feasible and sufficient for the average website owner?

Don't use reverse proxies you don't trust

Re: Password may not contain: select, insert, update, delete, drop

#123

Post by i_k_k »

matsemann wrote: post #56

Can not contain "script". I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including . I instead wrote ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..

Well, duh: they needed to make sure to run the script twice.

Re: Password may not contain: select, insert, update, delete, drop

#124

Post by sumo86 »

alanfranz wrote: post #115
matsemann wrote: post #56

Can not contain "script". I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including . I instead wrote ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..

oldest injection trick ever :-)

WoW

Re: Password may not contain: select, insert, update, delete, drop

#127

Post by wkat4242 »

Instead of making sure SQL injection is not possible at all by using proper stored procedures and other techniques, they just limit a few keywords and hope hackers don't come up with something that they haven't thought of like some escaping trick.

Yeah that would probably work for a while. Until someone proves it doesn't :P

It's not really rocket science anymore to make sure user input doesn't mix with your SQL. This is not 2005.

And really if this works in the first place you're storing the passwords unhashed which was even a dumb thing in 2005. If the same applies to the username or other user input fields it would make a bit more sense but passwords should never enter the database like that.

Re: Password may not contain: select, insert, update, delete, drop

#128

Post by SoftTalker »

wongarsu wrote: post #46
civilized wrote: post #35

I expect this will attract a lot of criticism, but I actually think it's a good idea, at least in some cases. There are a lot of people writing bad code and bad system architectures for their organizations. There are not enough people with the competence, organizational power, and time to catch what's bad and force change in those organizations. In the US you are probably forced to do business via many such terribly…

If an organization has such a password policy, that can be interpreted as the person in charge of setting this policy thinks their organization doesn't have enough people with the competence and organizational power to prevent SQL injection vulnerabilities. Which would reflect poorly on any institution, but especially a university (which should be a bastion of people with competence and organizational power). As for…

> especially a university (which should be a bastion of people with competence and organizational power)

Generally the opposite. University staff positions pay pretty poorly compared to what the most competent people can earn elsewhere.

There are some bright staff people at universities who are there for other reasons besides the pay, but the competence of an average university staff software developer is not great.

This is also why over the past two decades universities have trended to SaaS subscriptions rather than building software in-house

Re: Password may not contain: select, insert, update, delete, drop

#129

Post by jchw »

civilized wrote: post #118
jchw wrote: post #100

Earlier quoted context omitted.

I disagree. It may seem good on paper, but it gives you too much of a false sense of security. Security measures like this often seem to work, but they are papering over a deeper problem. Usually this is being done because user input is not being handled carefully, and if so, the assumption that blocking some keywords "defangs" potential exploits is usually easy to prove false. Consider the case of eBay and JSFuck[1]…

A lot of critical responses here are saying "this distracts from getting people to do the right thing". I'm open to that, but what is the plan for forcing organizations that are doing the wrong thing to do the right thing? We're talking about businesses that mismanage the sensitive data of millions of people. "They should be doing things right" doesn't seem like an adequate response to this situation.

Correct, we should be legally enforcing that they do the right thing, with legislation that has actual fangs, for companies like Equifax. It should be a potential bankruptcy event when you leak most of America's social security numbers through sheer incompetence.

The problem is that WAF-style security-theater is being enshrined as the industry standard instead, which means that we're just going to get more of these problems instead of less. In other words, a half-measure like this doesn't just distract from doing the right thing, it's actually literally useless for any real security, and instead it's more likely to allow serious security issues to go unnoticed for a much longer period of time.

Re: Password may not contain: select, insert, update, delete, drop

#130

Post by [deleted] »

matejn wrote: post #85

Oooh! I put that string there! It was a request by management, and I still don't know why. This site doesn't store any passwords, it's basically just a nice interface to external account management. I heard a rumour that some legacy apps have weird validation on their login fields, so students wouldn't be able to log in with passwords containing certain strings. But I don't actually know of any examples.

[deleted]
Post reply on HN