21–30 of 122 posts
Earlier quoted context omitted.
Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...
hunter2
> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?
This is way more common than you'd like, here's a scenario where it can happen even without outright incompetence: Someone (or some AI) copies an example auth implementation from stackoverflow. Being sensible they realise they shouldn't put key material in source code either, so they leave "secret" in place, and pop a ticket in JIRA to update with the key material from the vault before it goes live. Employee falls il…
Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.
Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...
Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.
Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...
Once upon a time, I ran ypcat passwd and piped it into John the Ripper on the CompSci Linux cluster at one of the University of California campuses. Within 90s, I had amassed passwords of over 40 users including several lecturers and a tenured professor. The CS IT shop's mistake was running NIS+ rather than something like LDAP + Kerberos.
Edit: ... god
Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.
Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...
I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.
> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?
I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.
Seriously! I actually can’t think of any openly documented security incident with such impressive remediation timelines. There’s a lot that has to go into fixing things on such a tight timeline too: - oncall-level alerting for your security.txt inbox - your oncall needs to either be someone who can actually take corrective action on the system in question (not easy in a large company!) or able to route the issue to t…