Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

71–80 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#71

Post by darepublic »

WD-42 wrote: post #61
darepublic wrote: post #44

A startup I worked for had this exact same security issue. I brought it up to the tech lead/CEO but they were in denial about it. Handrolled password reset by dummies basically

Why people are still hand rolling common stuff like this is baffling to me. I'm treading on offensive waters here, but I'd guess this is from a nodejs backend, for some reason it seems to be more common to hand roll stuff like this in node than pretty much any other web language/framework I've worked with.

I have handrolled a pass reset in node but I didn't give up the key back to the client. In this case it was actually spring framework

Re: Hacking Grindr Accounts with Copy and Paste

#72

Post by laurent92 »

godelski wrote: post #45
Nextgrid wrote: post #36

Earlier quoted context omitted.

This would detect a large-scale attack, but wouldn't detect small-scale, targeted attacks as they would just get lost in the noise of legitimate password resets. Furthermore, for dormant accounts (where the user is no longer using the app - potentially because they are now in a relationship) the user will not notice anything either, and the notification email is likely to get lost in the endless newsletter spam the n…

I think this is a good point. I'll admit that I'm naive about web and security (not my area). Are multiple password resets within a small time frame common? I would not expect this to be common, but user behavior has often defied my expectation. If it is uncommon I think you could create a correlation and get an estimate, if it is common then I completely agree that it would be lost in the noise. And yeah I agree tha…

> Are multiple password resets common within a small timeframe?

Yes. When you reset your password once, probability is high to reset it many times. It is often because you don’t remember it, and the new one isn’t fixated in your memory. Or because I’ve changed devices, but my computer kept my old password, so I reset it too, and back and forth on each device until I have time to bring the two devices together and type in the same password. Basically password resets happen rarely, except when they happen, they happen in a salve.

That is the exact opposite scenario of when London hired statisticians during the Battle of England because they were surprised how all German bombs fell on specific buildings, and were wondering why Germans would target those, only to discover that randomness meant bombs would randomly fall in clusters for no reason at all.

Re: Hacking Grindr Accounts with Copy and Paste

#73

Post by sneak »

sebmellen wrote: post #22
Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

$50 says they're not. This is something every organization has to say for PR reasons, but saying "we believe" is very fishy wording. It could well be this bug has been around for months before it was discovered, and used by many black/grey-hat hackers.

Governments. It was likely used by governments.

Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

Re: Hacking Grindr Accounts with Copy and Paste

#74

Post by newswasboring »

BoorishBears wrote: post #70
newswasboring wrote: post #54

Earlier quoted context omitted.

> But, to paraphrase Drag Race: men are rotted gila monsters. (I’m a gay male, I can say that. Also I speak from experience. I've seen things you people wouldn't believe.) No dude, being gay does not give you the license to be disrespectful towards all men.

Instead of trying to make this about yourself, maybe take the context and infer it as bringing some humor into their comment on a pretty serious topic

This joke made on any other community would be considered offensive.

Edit: Also they were explicitly giving themselves a license which I don't think should be taken. So I expressed that opinion.

Re: Hacking Grindr Accounts with Copy and Paste

#75

Post by jonplackett »

sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

Mental thought process of programmer:

Sooo... what's the one thing we need this token to be. Secret.

OK, let's just return it to the one person in the whole world we don't want to have it.

Mmmm is it lunchtime...?

Re: Hacking Grindr Accounts with Copy and Paste

#76

Post by [deleted] »

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

[deleted]

Re: Hacking Grindr Accounts with Copy and Paste

#77

Post by Ozzie_osman »

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

Well email tracking isn't perfect, but it can help a lot. A legitimate pattern you'd see an email open event, email click event, then successful reset in that order. An illegitimate one might have no email open or click before the reset, or clicks from multiple places or something like that. That could narrow down the list significantly.

Of course, not all email clients allow send these events.

Re: Hacking Grindr Accounts with Copy and Paste

#78

Post by godelski »

laurent92 wrote: post #72
godelski wrote: post #45

Earlier quoted context omitted.

I think this is a good point. I'll admit that I'm naive about web and security (not my area). Are multiple password resets within a small time frame common? I would not expect this to be common, but user behavior has often defied my expectation. If it is uncommon I think you could create a correlation and get an estimate, if it is common then I completely agree that it would be lost in the noise. And yeah I agree tha…

> Are multiple password resets common within a small timeframe? Yes. When you reset your password once, probability is high to reset it many times. It is often because you don’t remember it, and the new one isn’t fixated in your memory. Or because I’ve changed devices, but my computer kept my old password, so I reset it too, and back and forth on each device until I have time to bring the two devices together and typ…

This makes a lot of sense about why my priors were wrong. Thanks! (always gotta check your priors)

Re: Hacking Grindr Accounts with Copy and Paste

#80

Post by on_and_off »

sneak wrote: post #73
sebmellen wrote: post #22

Earlier quoted context omitted.

$50 says they're not. This is something every organization has to say for PR reasons, but saying "we believe" is very fishy wording. It could well be this bug has been around for months before it was discovered, and used by many black/grey-hat hackers.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I wonder why you are getting downvoted so much. I don't know how common bi-men are (probably more than bi erasure makes us believe) but it feels like a least a portion of them are not ready to come out as bi.
Post reply on HN