Ebay posts every character a user types into the password box
1–10 of 220 posts
Re: Ebay posts every character a user types into the password box
#2> why the website is sending docents of requests to Ebay’s servers.
"dozens" maybe?
Re: Ebay posts every character a user types into the password box
#3Bad title: it works only while you have the password field focused.
Bad content: when you log in or register you send your password to the servers anyway. It's irrelevant, since all connections (as shown in your post) are made with https.
One could argue "they are seeing what you write even if you haven't sent it yet", but meh, it's just a damn password field, not a chat field.
So bad, bad, bad.
Re: Ebay posts every character a user types into the password box
#4If someone has broken ebay https they will surely be able to catch the whole password at the end.
Re: Ebay posts every character a user types into the password box
#5Sending your password as you type it as a GET request query parameter seems awfully hazardous. As you point out the password will appear in all manner of places, such as HTTP server logs. As the username/email is not included an ops person might not directly know from the GET request alone what user the password belongs to. It is not difficult to imagine however that they have enough info to correlate the IP address of the password strength request with a user.
Re: Ebay posts every character a user types into the password box
#6Bad title: it works only while you have the password field focused. Bad content: when you log in or register you send your password to the servers anyway. It's irrelevant, since all connections (as shown in your post) are made with https. One could argue "they are seeing what you write even if you haven't sent it yet", but meh, it's just a damn password field, not a chat field. So bad, bad, bad.
They're embedding the password in a GET request. That'll get logged all over the place.
Re: Ebay posts every character a user types into the password box
#7Bad title: it works only while you have the password field focused. Bad content: when you log in or register you send your password to the servers anyway. It's irrelevant, since all connections (as shown in your post) are made with https. One could argue "they are seeing what you write even if you haven't sent it yet", but meh, it's just a damn password field, not a chat field. So bad, bad, bad.
He's got a point that sending via GET is kinda dirty. I'd hope ebay logs don't log the full url of requests. Sure, getting to those logs would be super difficult, but you really don't want plain text passwords anywhere.
In general though, yeah, not that exciting of an article.
Re: Ebay posts every character a user types into the password box
#8Bad title: it works only while you have the password field focused. Bad content: when you log in or register you send your password to the servers anyway. It's irrelevant, since all connections (as shown in your post) are made with https. One could argue "they are seeing what you write even if you haven't sent it yet", but meh, it's just a damn password field, not a chat field. So bad, bad, bad.
They're embedding the password in a GET request. That'll get logged all over the place.
[deleted]
Re: Ebay posts every character a user types into the password box
#9Bad title: it works only while you have the password field focused. Bad content: when you log in or register you send your password to the servers anyway. It's irrelevant, since all connections (as shown in your post) are made with https. One could argue "they are seeing what you write even if you haven't sent it yet", but meh, it's just a damn password field, not a chat field. So bad, bad, bad.
As I said in the Post, it is not a security vulnerability itself, but I want to point out that it can be very dangerous to put a password in a GET request.
And the response of ebay is bad too.
But thank you for your constructive comment ;)
Re: Ebay posts every character a user types into the password box
#10If someone has broken ebay https they will surely be able to catch the whole password at the end.
Same as every website where you can login.