Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons in website security anti-patterns by Tesco

troyhunt.com

Post reply on HN
Print view View original

71–80 of 120 posts

Re: Lessons in website security anti-patterns by Tesco

#71

Post by jiggy2011 »

marbletiles wrote: post #62

Reminds me of the banks with their "enter the first and fourth characters of your password"-type enhanced login forms. How are they doing that without storing the plaintext, then?

Perhaps when you set the password it generates a bunch of combinations of password chars that might ask you to enter and then hash these. Of course that does make them more exploitable because you can leak information about the password 1 or 2 characters at a time.

However your bank will have so much information stored about you that if your bank gets owned you're basically fucked anyway even if they don't get your password.

I imagine the servers that actually store this data however are secure to a ridiculous degree.

Re: Lessons in website security anti-patterns by Tesco

#72

Post by alinajaf »

peterwwillis wrote: post #63

What's really weird to me is how some people can foster an actual anti-security mindset, where they explicitly try to argue against proper security practices. I don't know where it comes from, but i've seen it often. You report that the way a particular type of SSL cert is implemented leaves a MITM attack, and they come back with a dissertation on why MITM is not a concern of ours. (Oh? Then why the fuck are we encry…

I've seen exactly this attitude multiple times with clients from a wide range of industries. So much so that I'd say that this is attitude towards security is the norm rather than the exception.

Re: Lessons in website security anti-patterns by Tesco

#73

Post by borplk »

simonw wrote: post #4
elithrar wrote: post #2

I watched this exchange occur over Twitter on the weekend; the worst part of it was not that Tesco stores the password in a reversible manner, but that their representative actively defended their mechanism. Otherwise, all of their other "crimes" (cookies are sent unencrypted, etc) are bad but not really unexpected from a large chain like this. I'm never really surprised when large organisations get these things so w…

If it was the weekend, it seems unlikely to me that the person running the Twitter account would have got in touch with someone with a technical understanding of how the site works. More likely they just consulted their list of talking points and picked the ones that looked most relevant to the situation.

This is the dilemma with customer service in big companies. They get too many queries so they just hire someone who knows nothing but how to make up official sounding responses to finish their day at work and go home.

Re: Lessons in website security anti-patterns by Tesco

#74

Post by jiggy2011 »

alsothings wrote: post #67
jiggy2011 wrote: post #17

Whilst I agree with the big one about plain text passwords some of the niggles here seem a little odd. Tesco are not advising that everyone goes back to IE 3, they are simply stating this as a lowest common denominator since I'm assuming that was the first browser to support whatever version of TLS they were using etc. Also, is running an old version of ASP.NET and IIS really a problem? Does he advocate going through…

The post advocates simply staying reasonably up to date, then says that IIS 6 is unreasonably old. relevant bit: This is not necessarily a high-intensity exercise, once every few years you simply make sure you haven’t fallen too far behind the eight ball. Certainly you don’t let key software components get 9 years old and nearly 5 versions out of date. This is quite a bit less intensive then you describe and I think…

IIS 6 is part of Windows 2003 Server, therefor it will be on "Extended Support" until 14/07/2015

http://support.microsoft.com/lifecycle/search/default.aspx?a...

This means that if there is some security vulnerability discovered with it then Microsoft will provide a patch, therefor from a security point of view it isn't "out of date".

The number of years and versions is fairly irrelevant, there will be plenty of very secure systems in use by banks and the military that will no doubt pre-date much of what tesco is using by several decades.

Re: Lessons in website security anti-patterns by Tesco

#75

Post by mikeash »

SideburnsOfDoom wrote: post #24

Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.

I can understand why they do this, sort of, but I can't understand how they have this mindset in the first place.

Imagine if they let criminals run riot through their stores, on the theory that they're in the business of selling meat and potatoes to everyone in the UK, not of policing stores. Well, it's true, but putting their customers at risk is wrong and bad for business.

No, this web site nonsense hasn't been bad for business... so far. I wouldn't be surprised if a major breach would change that in a hurry, though.

Re: Lessons in website security anti-patterns by Tesco

#76

Post by tibbon »

chrisacky wrote: post #14

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…

Several pages that do this:

(Search for "We send your password via email")

https://www.google.com/webhp?sourceid=chrome-instant&ie=...

Re: Lessons in website security anti-patterns by Tesco

#77

Post by gizmo686 »

codeka wrote: post #26

> In fact the only real possibility that leaves any credibility whatsoever is that the stored password is being decrypted then compared to the password provided at logon using a non-case sensitive comparer. You can do case-insensitive passwords with hashing/salting. It's just a matter of lower-casing the password before hashing it. (Edit: I'm not saying this is a good idea, of course!!) I remember reading once that F…

If you want hash based passwords to be case insensitive (or have case insensitive characters) You should convert the case before you hash on login. Saving every hash makes it easier for an attacker to find a collision.

Re: Lessons in website security anti-patterns by Tesco

#78

Post by yxhuvud »

omh wrote: post #31
Smerity wrote: post #15

Earlier quoted context omitted.

Google Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.

Poor security is just as dangerous as these, the only thing missing is the malicious intent. Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site. Unless/until Tesco have their databases hacked or stolen there is no risk at all.

Don't be ridiculous.

A conditional statement saying there is no risk is utter nonsense. The reason for this is very simple - there is always a risk the conditional has already been fulfilled.

Re: Lessons in website security anti-patterns by Tesco

#79

Post by OMBUG »

marbletiles wrote: post #62

Reminds me of the banks with their "enter the first and fourth characters of your password"-type enhanced login forms. How are they doing that without storing the plaintext, then?

I know Halifax at least uses a separate string for those checks, which presumably is stored unencrypted.

Re: Lessons in website security anti-patterns by Tesco

#80

Post by metachris »

jiggy2011 wrote: post #61

The plain text password thing might have been an edict come down from marketing. For example, they might find that people who forget their password become less likely to use the site because when they get their new (hard to remember) password emailed to them they can't figure out how to change the password back to what it used to be. This means they end up resetting their password every week to do their shopping.

But... a proper password reset mechanism wouldn't send the password via email in first place, but rather a one-time link to set a new one.
Post reply on HN