Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we discovered a database leak in one of the biggest Swiss hosting providers

security.infoteam.ch

Post reply on HN
Print view View original

41–50 of 68 posts

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#41

Post by Domenic_S »

theandrewbailey wrote: post #37
codetrotter wrote: post #18

Earlier quoted context omitted.

Email validation regexes are so annoying. Everyone ought to just use .+@.+ as their validation regex and not be more strict than that. Beyond that just queue and try to deliver the email. Tell the user than an email should arrive shortly and that if it doesn’t they should check their spam folder and that they should check that they gave the correct email address. When you say this you repeat the email address that th…

Sorry, but .+@.+ isn't going to cut it if you want to confidently accept deliverable email addresses. Regex valid, but not email valid: codetrotter@example code@trotter@example.com code trotter@example.com codetrotter@example..com codetrotter@example.com. .codetrotter@example.com My company runs a website that has elderly people signing up for newsletters. The client is paranoid about not getting every last drop of p…

An email address being syntactically valid is no guarantee that the mailbox even exists or is correctly mapped to the person at the keyboard!

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#42

Post by strictnein »

TheRealPomax wrote: post #39

For the longest time a "clean" MySQL install would set up an no-password superuser for presumably dev convenience. I don't know if they changed that (it's been a while since I last installed MySQL) but if not, this could simply be a security hole by design, with the maintainers simply not paying attention to their install script flags.

I thought it was no password, but only available via localhost?

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#43

Post by [deleted] »

theandrewbailey wrote: post #37
codetrotter wrote: post #18

Earlier quoted context omitted.

Email validation regexes are so annoying. Everyone ought to just use .+@.+ as their validation regex and not be more strict than that. Beyond that just queue and try to deliver the email. Tell the user than an email should arrive shortly and that if it doesn’t they should check their spam folder and that they should check that they gave the correct email address. When you say this you repeat the email address that th…

Sorry, but .+@.+ isn't going to cut it if you want to confidently accept deliverable email addresses. Regex valid, but not email valid: codetrotter@example code@trotter@example.com code trotter@example.com codetrotter@example..com codetrotter@example.com. .codetrotter@example.com My company runs a website that has elderly people signing up for newsletters. The client is paranoid about not getting every last drop of p…

[deleted]

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#44

Post by plopz »

theandrewbailey wrote: post #37
codetrotter wrote: post #18

Earlier quoted context omitted.

Email validation regexes are so annoying. Everyone ought to just use .+@.+ as their validation regex and not be more strict than that. Beyond that just queue and try to deliver the email. Tell the user than an email should arrive shortly and that if it doesn’t they should check their spam folder and that they should check that they gave the correct email address. When you say this you repeat the email address that th…

Sorry, but .+@.+ isn't going to cut it if you want to confidently accept deliverable email addresses. Regex valid, but not email valid: codetrotter@example code@trotter@example.com code trotter@example.com codetrotter@example..com codetrotter@example.com. .codetrotter@example.com My company runs a website that has elderly people signing up for newsletters. The client is paranoid about not getting every last drop of p…

codetrotter@example is a valid email

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#45

Post by Xylakant »

theandrewbailey wrote: post #37
codetrotter wrote: post #18

Earlier quoted context omitted.

Email validation regexes are so annoying. Everyone ought to just use .+@.+ as their validation regex and not be more strict than that. Beyond that just queue and try to deliver the email. Tell the user than an email should arrive shortly and that if it doesn’t they should check their spam folder and that they should check that they gave the correct email address. When you say this you repeat the email address that th…

Sorry, but .+@.+ isn't going to cut it if you want to confidently accept deliverable email addresses. Regex valid, but not email valid: codetrotter@example code@trotter@example.com code trotter@example.com codetrotter@example..com codetrotter@example.com. .codetrotter@example.com My company runs a website that has elderly people signing up for newsletters. The client is paranoid about not getting every last drop of p…

There is a other email that the regexp lets pass and that’s still not valid:

codetrotter@example.com

It conforms to the expectated format and could be a valid email, but it’s actually not because no such user exists.

An email might also exist, but not accept mail from you.

The given email address might exist, by could belong to another user.

There’s a million things that can go wrong and you’ll have a very hard time catching them.

The only way to identify if an email is valid and accepts mail is to actually send an email there.

You can, as a help for the user identify odd looking email addresses and flag them in the UI (“this looks unusual, are you sure”), but generally speaking, chances are high that any strict validation will reject real world addresses while not catching all errors.

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#47

Post by ScottBurson »

Mashimo wrote: post #5

Can't test the product they try to promote because emails with a `+` in them are not valid.

> emails with a `+` in them are not valid

Wrong: https://en.wikipedia.org/wiki/Email_address#Syntax

(I know this is of little help if your email app doesn't allow them. I just want to point out that the standard does allow them.)

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#48

Post by [deleted] »

redsec wrote: post #25

A little update on the service Security Guardian after the publication of this post. Thanks to Hacker News and its incredible community, there have been a massive number of new users. We are working on adding more resources to the infrastructure to make the scans quicker. For now, it is possible that some of you have to wait some hours before receiving the first results. Thanks for trying our new product, we hope to…

[deleted]

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#49

Post by theandrewbailey »

plopz wrote: post #44
theandrewbailey wrote: post #37

Earlier quoted context omitted.

Sorry, but .+@.+ isn't going to cut it if you want to confidently accept deliverable email addresses. Regex valid, but not email valid: codetrotter@example code@trotter@example.com code trotter@example.com codetrotter@example..com codetrotter@example.com. .codetrotter@example.com My company runs a website that has elderly people signing up for newsletters. The client is paranoid about not getting every last drop of p…

codetrotter@example is a valid email

I should have been more specific: an email address that is routable over the internet. Where's the TLD on that?

Re: How we discovered a database leak in one of the biggest Swiss hosting providers

#50

Post by coldacid »

ScottBurson wrote: post #47
Mashimo wrote: post #5

Can't test the product they try to promote because emails with a `+` in them are not valid.

> emails with a `+` in them are not valid Wrong: https://en.wikipedia.org/wiki/Email_address#Syntax (I know this is of little help if your email app doesn't allow them. I just want to point out that the standard does allow them.)

I think what Mashimo means is that Infoteam.ch thinks that `+` is invalid when it isn't. Sadly they're far from the only ones whose email validation code won't accept the plus character, or many other legal characters in the local part of an email address.
Post reply on HN