Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

minimaxir.com

Post reply on HN
Print view View original

21–30 of 112 posts

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#21

Post by Negitivefrags »

nvmc wrote: post #12
Negitivefrags wrote: post #8

Earlier quoted context omitted.

> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go. Be very careful here, it's not as simple as it looks. If you don't do…

Just out of interest, what is your game?

Here is our site: http://www.pathofexile.com/

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#22

Post by minimaxir »

Evbn wrote: post #16

Please change your CSS so it doesn't force Android to show a microscopic font with long lines and disabled zoom/ reflowing.

The CSS is based off of Bootstrap, so everything should be showing correctly on mobile and tablets (I don't have an Android device myself so I can't verify that particular use case). I'll look into it; in the meantime, I enabled zoom for mobile devices.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#23

Post by Negitivefrags »

ams6110 wrote: post #10
Negitivefrags wrote: post #8

Earlier quoted context omitted.

> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go. Be very careful here, it's not as simple as it looks. If you don't do…

It really isn't as easy as it sounds, is it? A better approach might be to UPDATE promo_codes SET used = 1 WHERE ... AND used = 0 , and then check that one update occurred. Or if your db supports it, SELECT ... FOR UPDATE OF ... and then update if the code is not yet used. You want the check and the update to occur atomically. And this varies depending on databases, for example in Oracle even if you explicitly begin…

I actually wasn't personally involved in the solution, but I believe that we went with something involving SELECT FOR UPDATE.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#24

Post by andypants »

Your proposed solution is not that simple. You make it sound like EA simply used the wrong query.

> One, if EA is technically incompetent enough to allow such a severe bug to exist, they won’t have the technical skills to discern who used the promo code more than once.

The bug was not that obvious, and doesn't necessarily imply lack of technical skill. On the other hand, finding out who used a promo code more than once, as long as these things have been logged, should be trivial for any admin.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#25

Post by minimaxir »

spicyj wrote: post #18
minimaxir wrote: post #15

Earlier quoted context omitted.

I figured out the error (I was wrong, it was indeed my code) and fixed it. No more flickering. :)

Out of curiosity, what was the bug?

On my main page, I use AJAX to load the Share buttons when the user mouses-over the post itself, so that they aren't loaded all at once. Specifically, it loads the HTML, then runs it through each social service's HTML parser to render the buttons.

On individual blog posts, the buttons did not load because the DOM element is not present for that template. However, the parser still ran on mouse-over, which is what caused the flickering. So I just disabled the parser when the user is on an individual blog post.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#26

Post by spicyj »

minimaxir wrote: post #25
spicyj wrote: post #18

Earlier quoted context omitted.

Out of curiosity, what was the bug?

On my main page, I use AJAX to load the Share buttons when the user mouses-over the post itself, so that they aren't loaded all at once. Specifically, it loads the HTML, then runs it through each social service's HTML parser to render the buttons. On individual blog posts, the buttons did not load because the DOM element is not present for that template. However, the parser still ran on mouse-over, which is what caus…

Gotcha. :)

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#27

Post by mherdeg »

numair wrote: post #17
Negitivefrags wrote: post #8

Earlier quoted context omitted.

> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go. Be very careful here, it's not as simple as it looks. If you don't do…

... That's not a timing attack. A timing attack involves measuring the time taken to return an invalid response to a password attempt and, given enough tries, figure out the password based on this. It usually takes advantage of the way that string-matching code is written in libraries. Preventing this is not nearly as simple as you may think; for example, recent research shows that over a long enough period of time a…

Yeah, time-of-check-to-time-of-use attacks are not usually described as "timing attacks" but instead just called TOCTTOU. In this scenario you might also say "exploiting a race condition".

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#28

Post by CamperBob2 »

minimaxir wrote: post #22
Evbn wrote: post #16

Please change your CSS so it doesn't force Android to show a microscopic font with long lines and disabled zoom/ reflowing.

The CSS is based off of Bootstrap, so everything should be showing correctly on mobile and tablets (I don't have an Android device myself so I can't verify that particular use case). I'll look into it; in the meantime, I enabled zoom for mobile devices.

in the meantime, I enabled zoom for mobile devices.

Whoever turned it off in the first place was a bad person, and should feel bad for doing so.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#29

Post by tantalor »

IANAL, but it's possible that these users are now liable to pay for the extra games. They knew that the code was only usable once, yet used it multiple times. EA might ask for the games back or charge the users.

(I'm not taking EA's side, I'm just pointing out some possible consequences.)

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#30

Post by minimaxir »

CamperBob2 wrote: post #28
minimaxir wrote: post #22

Earlier quoted context omitted.

The CSS is based off of Bootstrap, so everything should be showing correctly on mobile and tablets (I don't have an Android device myself so I can't verify that particular use case). I'll look into it; in the meantime, I enabled zoom for mobile devices.

in the meantime, I enabled zoom for mobile devices. Whoever turned it off in the first place was a bad person, and should feel bad for doing so.

Having zoom enabled and changing device rotation can cause formatting issues on some devices. The mobile (smartphone) websites of TechCrunch, Yahoo, Cnet, Mashable, etc. all disable mobile zoom.

Tablets appear to be a different story though, and zoom might need to be enabled there.

Post reply on HN