111–120 of 127 posts
Earlier quoted context omitted.
So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately? Kind of a jerk move.
While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.
Does anyone know how Project Euler was storing the passwords?
Usernames cannot contain more than 32 characters and they may only contain upper/lower case alphanumeric characters (A-Z, a-z, 0-9), dot (.), hyphen (-), and underscore (_). Passwords must contain between 8 and 32 characters. My money is on "ineptly."
I took that to mean that prior to being pwnd they had been storing passwords cleartext and would no longer be doing so.
Also, the wording about allowed special characters seems to be incorrect. I personally have a non ./-/_ special character in mine. Unless they are doing something terribad like silently discarding noncompliant parts of the password.
Re: password length - at least 32 characters is respectable. I believe last time I used outlook.com they had a max length of 12-16!
Earlier quoted context omitted.
Usernames cannot contain more than 32 characters and they may only contain upper/lower case alphanumeric characters (A-Z, a-z, 0-9), dot (.), hyphen (-), and underscore (_). Passwords must contain between 8 and 32 characters. My money is on "ineptly."
I can't find it now but I seem to remember this came up in response to another breach ~24 months ago. At that time they made an announcement to the effect that from then on you'd no longer be able to have your password sent to you if you forgot it, but that you would instead need to use an account recovery key. I took that to mean that prior to being pwnd they had been storing passwords cleartext and would no longer…
When setting the password, max length was only enforced by a text input with a max length attribute. You could happily type more characters and everything would work as expected....until you went to log in. The max length on the password field on the login form was greater so those characters that were silently dropped when setting the password suddenly weren't.
Earlier quoted context omitted.
While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.
I think you're confusing "exploit" and vulnerability. An info leak is a vulnerability. Period. And yes. You completely went around their request, and made this info public without their consent. Actions like this are THE reason the relationship between vendors and security researchers is strained. There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosu…
You can list what problems you've solved by showing an image generated for you. Ex) https://projecteuler.net/profile/daguava.png But you can also use this to quickly test the status of accounts. For example, I was able to find Euler is an admin account by trying https://projecteuler.net/profile/euler.png It tells you it's admin in the image, why? Edit: Wonder if they're exposing some vulnerability with the HTTP 300 M…
https://projecteuler.net/level=19
Look for the gold stars
Earlier quoted context omitted.
Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists. #2-#5 are all good points, though, and would help prevent username enumeration as well.
Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists. Agreed, but I would lean towards giving the bad guys as few tools as possible. If you require a captcha to register, an…
Earlier quoted context omitted.
Fair enough, just frustrated with the overwhelming number of "the modern internet is broken!!" posts that have been clogging up the front page lately. That also happened to be one particularly light on content.
the modern internet is broken (not to mention interfaces, languages, security, identity, manufacture, physics and pop-tarts) and if you get upset at people pointing out how much nicer things could be, then things probably wont
> In 2015, becoming a Web developer is all about learning Ruby or figuring out Node.js, not just building cool things you like.
This is patently wrong. Maybe it was harsh to call him a moron but the content was very weak in that particular piece.
Earlier quoted context omitted.
"How hard can it be?" <--- yeah, that's how you end up with vulnerable sites.
Not if you make security your number one goal from the beginning. But "letting the community rewrite the site" would be very complicated, especially on a niche website such as Project Euler, where a lot of its users are opinionated and would probably take a long time to reach consensus on anything.