Tarsnap email confirmation bypass
daemonology.net
Tarsnap email confirmation bypass
1–10 of 51 posts
Re: Tarsnap email confirmation bypass
#2tl;dr
a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code.
also, there is no bug bounties for the tarsnap website, only for tarsnap code.
Re: Tarsnap email confirmation bypass
#3tl;dr a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. also, there is no bug bounties for the tarsnap website, only for tarsnap code.
a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code.
That's a decent summary, but I didn't think I was all that long-winded...
Re: Tarsnap email confirmation bypass
#4tl;dr a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. also, there is no bug bounties for the tarsnap website, only for tarsnap code.
a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. That's a decent summary, but I didn't think I was all that long-winded...
Quite the opposite, it's nice to see someone put some effort into their write-ups. It's so much more readable as a story.
Re: Tarsnap email confirmation bypass
#5[deleted]
Re: Tarsnap email confirmation bypass
#6tl;dr a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. also, there is no bug bounties for the tarsnap website, only for tarsnap code.
a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. That's a decent summary, but I didn't think I was all that long-winded...
Oh it really is just a summary, and no commentary as to whether TFA was long-winded or not. That's left to decide for each individually.
Re: Tarsnap email confirmation bypass
#7Lesson of the day: Hidden form values are not hidden from the user, they just aren't plainly visible to the user on screen.
Never "hide" sensitive data in those hidden input fields.
Re: Tarsnap email confirmation bypass
#8The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly run into on the Internet, your past self is one of the strangest.
Re: Tarsnap email confirmation bypass
#9Earlier quoted context omitted.
a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. That's a decent summary, but I didn't think I was all that long-winded...
Oh it really is just a summary, and no commentary as to whether TFA was long-winded or not. That's left to decide for each individually.
When you write tl;dr followed by a very short summary, doesn't that itself imply that the article was long?
Re: Tarsnap email confirmation bypass
#10The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…
This has happened to me more times than I would like heh. Makes me realise the fallibility of memory.