Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

381–390 of 393 posts

Re: Safari tries to fill username

#381

Post by AlfeG »

sipos wrote: post #344
AlfeG wrote: post #310

Earlier quoted context omitted.

Some hired "pentesters" found in our Asp.Net application that "Connection to the prod database is established before the user credentials have been validated.". They even insist that this is come from some ISO security guidelines. Cheese, this one line in their report causes around 3 hours of meetings with around 10-20 people on them... and there were a lot of lines like this.

This is the DB that contains the usernames and (hashed) passwords right? What do they expect? That you have a separate DB for authentication from everything else? What does that achieve? If you DoS the auth DB, you still DoS the application in this scenario.

Actually yes.

They try to sell us external/internal Auth service, similar to KeyCloack with their support. What pentesters want to achieve is not improved security, but to sell their services as DevOps and developers. This were not what we expected from pentesting.

Re: Safari tries to fill username

#382

Post by monsieurbanana »

thaumasiotes wrote: post #78
monsieurbanana wrote: post #53

Earlier quoted context omitted.

> Or they should go and push for spec change

That attitude basically endorses the idea that the spec is God-given. There's nothing so important about getting the spec changed before you start ignoring it.

> That attitude basically endorses the idea that the spec is God-given

That's a tad over-dramatic. And context matters, surely I don't need to remind you why Google is spending so much money on Chrome?

Having a company control 70% of the browser market is bad enough, we don't need people telling them to go ahead and ignore specs, remember that they don't make those decisions out of goodwill for us.

Re: Safari tries to fill username

#383

Post by jpttsn »

jefftk wrote: post #199
jpttsn wrote: post #68

Earlier quoted context omitted.

Honest question: Do we have any scroll vs. marquee type situations today? Because (Unpopular): I believe the standard should primarily cover how the overlapping functionality works, and refrain from limiting or prescribing the extent of functionality. Comparing: If I build a HTTP API, I don’t have to support the DELETE verb for any endpoints. I can support ENCHANT if I want magic that other servers don’t have. But if…

> Because (Unpopular): I believe the standard should primarily cover how the overlapping functionality works, and refrain from limiting or prescribing the extent of functionality ... the standard body has just overplayed it’s hand. But that is how web standards work already? Vendors are not prohibited from adding additional functionality.

A lot of comments say Safari is not implementing web standards, by virtue of not implementing e.g. push notifications.

Re: Safari tries to fill username

#384

Post by jefftk »

jpttsn wrote: post #383
jefftk wrote: post #199

Earlier quoted context omitted.

> Because (Unpopular): I believe the standard should primarily cover how the overlapping functionality works, and refrain from limiting or prescribing the extent of functionality ... the standard body has just overplayed it’s hand. But that is how web standards work already? Vendors are not prohibited from adding additional functionality.

A lot of comments say Safari is not implementing web standards, by virtue of not implementing e.g. push notifications.

Those comments are correct: there are many web standards that Safari has either decided not to implement, or has not gotten around to yet. A browser doesn't have to implement a new feature just because it has been standardized.

Re: Safari tries to fill username

#385

Post by kstrauser »

bradknowles wrote: post #377
kstrauser wrote: post #340

Earlier quoted context omitted.

"Look, I'm going to be honest with you: your pentesters are morons. They're grossly incompetent and should be embarrassed. I can give you a list of qualified alternatives you might want to choose from, and not just to test the work I've done for you, but for all your other projects too. Seriously, their advice is just awful and you really need to switch." This isn't the time to tread lightly, but to go scorched earth…

The key here is to make this a do-or-die conversation. Tell the customer the truth, and then tell them you’re not going to work for them any more if they keep the other morons on the payroll — you’re not going to risk your reputation and your business on being associated with that other company. “I’m sorry if this means we can’t do business any more, but this situation has gotten so severe, that I just have to tell y…

Yep. This isn’t just complaining about someone saying something you don’t like. You mean business, literally.

Re: Safari tries to fill username

#386

Post by captainmuon »

lucb1e wrote: post #229
captainmuon wrote: post #5

Too much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving car…

What is the "pedestrian" approach to self-driving cars? You mean walking rather than driving?

Haha pun not intended. Yeah I mean something like cruise control + lane keeping which has a limited scope but is predictable and doesn't tempt people to move to the back seat and get killed. Or maybe virtual "rails".

Re: Safari tries to fill username

#387

Post by nathell »

bradknowles wrote: post #378
emodendroket wrote: post #276

Earlier quoted context omitted.

NTFS is case-sensitive.

It is case-preserving, but not case-sensitive. So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case. The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.

APFS still defaults to case-preserving:

    [nathell@macmini /tmp]$ echo first > A
    [nathell@macmini /tmp]$ echo second > a
    [nathell@macmini /tmp]$ cat A
    second

Re: Safari tries to fill username

#388

Post by randombits0 »

deergomoo wrote: post #268
oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

In the biz. What you need to do is address each issue with dispassionate detail in the response. Make no value judgements in the individual responses. Feel free to use words like “incorrect”, “false”, and my personal favorite, “logical inconsistency”. Quote specs, RFCs, platform dynamics, everything. Use diagrams, flowcharts, whatever it takes. But again, dispassionate, detached, and nonjudgmental. Then...

In the very last paragraph, as a conclusion to YOUR exercise, explain how the utter lack of competence in the subject matter displayed by the consultant has resulted in blah, blah, dollars, time, effort, all down the drain. Emphasize the harm to the organization and how it affects the trust required between different groups.

I guarantee it will get you promoted or fired. Which one depends on the organization and I expect you already know what will happen.

Re: Safari tries to fill username

#389

Post by emodendroket »

bradknowles wrote: post #378
emodendroket wrote: post #276

Earlier quoted context omitted.

NTFS is case-sensitive.

It is case-preserving, but not case-sensitive. So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case. The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.

That's how Windows will behave but not actually how the underlying filesystem does.

Re: Safari tries to fill username

#390

Post by ratcline »

vunuxodo wrote: post #252
jwr wrote: post #211

Earlier quoted context omitted.

In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".

Taken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.

I heard that systems like this were designed when there was a point in time(this may just be erroneous and such a time never actually existed) where keyloggers were more common than RATs, so government websites would often have this requirement due to the higher probability of access from public computers(library, etc), since that was also a point in time when fewer people had their own at home.
Post reply on HN