Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ebay posts every character a user types into the password box

slashcrypto.org

Post reply on HN
Print view View original

51–60 of 220 posts

Re: Ebay posts every character a user types into the password box

#51

Post by venomsnake »

pyre wrote: post #12
venomsnake wrote: post #4

If someone has broken ebay https they will surely be able to catch the whole password at the end.

As others are saying, using a GET request embeds that password in the URL, which means that server logs on eBay's side will have your password in them. Server logs aren't always the most protected thing in terms of locking down systems and permission management. On the flip side, most server logs do not have POST/PUT data logged.

But the requests were POST in the picture.

Edit: They do also send GET ... that is worse.

Re: Ebay posts every character a user types into the password box

#52

Post by developer2 »

arviewer wrote: post #50
TorKlingberg wrote: post #38

Earlier quoted context omitted.

They prefer to implement their password strength measurement server side for some reason. Maybe they don't want to make it public by doing it it JavaScript. Or they want to disallow reusing previous passwords, without leaking them to the client.

You can use a client check to check for the basic requirements, like minimum and maximum length, characters required or allowed etc. Then when the user submits his password, you can do a serverside check.

The reason for using a server-side solution is for a password strength indicator. You need the full algorithm to run against the current entry, and every user-friendly implementation does this on every character input so you know when what you have typed is "strong enough". I'm not particularly a fan of password strength indicators in general, but if you're going to do it at least do it cleanly.

Re: Ebay posts every character a user types into the password box

#53

Post by developer2 »

splatcollision wrote: post #14

I knew there was a reason I always prefer POSTing data as opposed to GET query params. It still gives attackers the knowledge that if they can get access to the logfiles, they can see passwords. Then the problem becomes getting access to the logfiles! Any leak of relevant information about security is of potential value.

It's less of a concern about an attacker gaining access to the log files, as it is that passwords should simply not be stored plaintext... anywhere. One doesn't really need to ask "why", it's just good common sense.

Re: Ebay posts every character a user types into the password box

#54

Post by developer2 »

splatcollision wrote: post #14

I knew there was a reason I always prefer POSTing data as opposed to GET query params. It still gives attackers the knowledge that if they can get access to the logfiles, they can see passwords. Then the problem becomes getting access to the logfiles! Any leak of relevant information about security is of potential value.

It's less of a concern about an attacker gaining access to the log files, as it is that passwords should simply not be stored plaintext... anywhere. One doesn't really need to ask "why", it's just good common sense.

Re: Ebay posts every character a user types into the password box

#56

Post by chiph »

vmateixeira wrote: post #43
wimagguc wrote: post #21

> there are some reasons behind our current solutions but I wouldn’t be able to give you more details on it. I'd be curious to know if anyone here can come up with a good enough reason for sending out the user's email & their password(-prefix) at every keystroke?

Building a user's password dictionary?

With common misspellings.

Re: Ebay posts every character a user types into the password box

#58

Post by iask »

After reading the public post and these comments, do you think they (eBay) will give a better explanation...or better, an explanation...as to why they do this? Passwords are becoming difficult to maintain, even with a password manager. They should've, at least, obfuscate it in some way.

Re: Ebay posts every character a user types into the password box

#59

Post by mschuster91 »

cmdrfred wrote: post #48
icebraining wrote: post #47

Earlier quoted context omitted.

Pinning doesn't work against the "corporate CA" scenario, at least if the user is using Chrome: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature t…

Thanks for that. I had no idea. I wish there was a way to grab the certificate in Js. Just so you could alert the user that they are MITMed. As it stands I will have to instruct them to check manually.

You could use https://openpgpjs.org/ for example to provide in-browser cryptography between user and server.

Re: Ebay posts every character a user types into the password box

#60

Post by lstamour »

ivanhoe wrote: post #57

how do you know that they didn't disable logs for this url?

Because (a) it's very unlikely given the use of POST elsewhere that they even realised this was using GET, and (b) other services can log URLs, such as your browser's history. By default, it may not matter, but perhaps of extensions get involved...

It's true, this isn't a straightforward vulnerability but it doesn't seem to be well-considered given the inconsistent use of both GET and POST for the same terrifying call.

Post reply on HN