Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#231

Post by pasc1878 »

_HMCB_ wrote: post #179
limelight wrote: post #173

Earlier quoted context omitted.

It's truly baffling how they manage to consistently make the software worse every single release. I was a huge fan of 1Password many years ago (and have been happy to pay for it throughout), but each successive release is more confusing and less reliable.

Agreed. Especially on iOS has it become obtrusive. Form inputs being obscured by mini pop-ups. I could go on. I’m waiting for the release of the new macOS and I’m going to evaluate using the native implementation and ditching 1P.

The promlem with using apple password management on macos is that I need vertical tabs. Only vivaldi and Firefox provide them now and they don't use the macos key chain

Re: Tell HN: Somebody implemented something I wrote a blog about

#233

Post by duckmysick »

v64 wrote: post #171

> Tell people about things you do that they played a part it- it might just make their day. Thank you for putting this out there! I once reverse engineered the protocol for a popular mobile game so I could write my own client for it and posted my library online for others to do the same without any expectation it'd ever get seen. Months later, I received an email from someone reverse engineering the protocol as well…

Impressive story!

Did the devs try to further obfuscate the protocol after they discovered your library?

Re: Tell HN: Somebody implemented something I wrote a blog about

#234

Post by Tangurena2 »

dalmo3 wrote: post #122
BeefWellington wrote: post #83

Earlier quoted context omitted.

Note that this is not universal to all systems. If your 2FA options all require the user to enter a code, you can simply display a "Please enter your 2FA code" dialog without divulging what kind of 2FA the user has.

How would you prevent someone from spamming a user just by knowing their username? Say, if the 2FA is done by SMS, or email. An attacker brute-forcing the password could flood the user with multiple messages. The usual response is doing a password reset, but that wouldn't work in your system. I wonder how systems that use magic links handle this.

> How would you prevent someone from spamming a user just by knowing their username?

Wasn't something like this how Uber got hacked recently? Spamming the target until they clicked "yes" on the 2FA prompt?

Re: Tell HN: Somebody implemented something I wrote a blog about

#235

Post by randac »

jabbany wrote: post #212
Jemaclus wrote: post #187

Earlier quoted context omitted.

> Now, if someone fails the password check, clearly the user's current password is still secure so leaking that the attempted password was wrong to an attacker is not particularly helpful to them. Maybe I misunderstand your post, but I think the parent comment is talking about leaking whether a password is correct and not whether it's wrong . (If I did misread your comment, apologies in advance and disregard the rest…

But the moment the attacker knows the password is correct, you/the platform would also know the password is compromised assuming they cannot get past 2FA. There is an extremely limited amount of situations that end up with "passed password authentication but failed 2FA" and all the platform needs to tell them apart is a simple "Hmm, were you attempting to login?" email or notification. The leak of the password's corr…

This is fine as long as you notify the account holder based on both a failed 2FA OR just ignoring the 2FA prompt rather than making an attempt.

Personally I don't know enough to know if that's the case?

Re: Tell HN: Somebody implemented something I wrote a blog about

#237

Post by Bedon292 »

thimkerbell wrote: post #236

Do people generally find it easy to find a channel for telling the product maker about the bug or potential improvement?

If something bugged me enough I really wanted to provide feedback, I don't think I have ever not found a way to send it. There is normally some way to do it but definitely can be tricky. GitHub issues, feedback forms, or even just the contact us page on their website. Not guaranteed to get a response, but at least an attempt was made. And it certainly can take a level of dedication and technical knowledge not everyone might have.

Re: Tell HN: Somebody implemented something I wrote a blog about

#238

Post by hamoid »

Once I realized that Flash .swf files could be compressed to half the size using gz, so I sent an e-mail to Macromedia suggesting that they zip their files. The next version had that feature enabled by default, which made me happy :-)

Also, at the time when interactive maps had 4 arrows to click and move North, South, East and West I developed a map using Flash and MapServer where you could drag the map around with the mouse. I sent a message to Google to show my work and they replied saying it was cool. Later Google maps came out with such an interface. I'll never know if my messages had any impact but I can still dream they were my inventions :-)

Re: Tell HN: Somebody implemented something I wrote a blog about

#239

Post by [deleted] »

jabbany wrote: post #212
Jemaclus wrote: post #187

Earlier quoted context omitted.

> Now, if someone fails the password check, clearly the user's current password is still secure so leaking that the attempted password was wrong to an attacker is not particularly helpful to them. Maybe I misunderstand your post, but I think the parent comment is talking about leaking whether a password is correct and not whether it's wrong . (If I did misread your comment, apologies in advance and disregard the rest…

But the moment the attacker knows the password is correct, you/the platform would also know the password is compromised assuming they cannot get past 2FA. There is an extremely limited amount of situations that end up with "passed password authentication but failed 2FA" and all the platform needs to tell them apart is a simple "Hmm, were you attempting to login?" email or notification. The leak of the password's corr…

[deleted]

Re: Tell HN: Somebody implemented something I wrote a blog about

#240

Post by travisjungroth »

Cthulhu_ wrote: post #219
spuz wrote: post #32

OWASP actually includes this suggestion in their guidance for implementing MFA: https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_A... > When a user enters their password, but fails to authenticate using a second factor...: > ... > Notify the user of the failed login attempt, and encourage them to change their password if they don't recognize it. > The notification should include the time, browser and geogra…

Yeah I thought it weird that you only get an e-mail that someone logged in under a new account - passing the 2fa. But they should send one after correct username / password too. I don't mind getting an e-mail as another form of 2fa, but that has its own issues.

I think the email is just a failure notification, not a second factor.
Post reply on HN