Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
| From | Sylvia Else <sylvia@not.at.this.address> |
|---|---|
| Newsgroups | comp.misc |
| Subject | Re: Ebay hacked |
| Date | 2014-05-26 17:03 +1000 |
| Message-ID | <bug7a1Fu8ktU1@mid.individual.net> (permalink) |
| References | (1 earlier) <slrnlns7m5.scb.g.kreme@amelia.local> <vg3oayn5gh3.fsf@coffee.modeemi.fi> <llqipl$59h$1@dont-email.me> <budrskFf0vtU2@mid.individual.net> <ar1a5b-gp7.ln1@news.chingola.ch> |
On 26/05/2014 6:53 AM, Paul Sture wrote: > On 2014-05-25, Sylvia Else <sylvia@not.at.this.address> wrote: >> On 25/05/2014 2:53 AM, Rich wrote: >> >>> >>> "Spaces and certain symbols (< >[ ]//) are not allowed in password." >>> >>> A properly designed password storage (using a hashing function such as >>> bcrypt or scrypt) does not care what symbols are in the password. >>> >>> Caring about specific symbols in the password implies they are not >>> following proper password storage models. >>> >> >> I wonder where the restriction is enforced - both on the client and at >> the server, or just in the client? How many here would be surprised if >> it were the latter? > > It would not surprise me to find that there was a server side restriction > at some time in the past, and they implemented client side validation for > that. > > Roll on a few years to the point where that server side restriction no > longer exists, but because folks have lost track of all the services > involved nobody can say for sure that nothing still has it. > > Thus the validation code lives on, and nobody has the guts to rip it out. > The concern is that the restriction exists to prevent some kind of injection vulnerability. If the restriction either never exists on the server, or is removed therefrom, then the vulnerability is exposed. Some while ago, I had to go to some considerable lengths to convince a senior system architect that a server could not trust client-side Java code. He was sure that doing so was how the banks had been implementing the Internet banking services. I dare say there are plenty of people who think that since you've just downloaded the code (Java, Javascript, or whatever) to the client, that the code can be trusted to do what you intend. It's hard to see how we'll ever get security when such fundamental misunderstandings persist. Sylvia.
Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-22 17:38 +1000
Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-22 13:35 +0000
Re: Ebay hacked Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-05-24 14:32 +0100
Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-22 15:59 +0000
Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-23 17:06 +0300
Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:13 +0000
Re: Ebay hacked Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-24 20:45 +0100
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:33 +1000
Re: Ebay hacked Jerry Peters <jerry@example.invalid> - 2014-05-25 20:19 +0000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 21:50 +0000
Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:53 +0000
Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-24 21:12 +0300
Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 18:33 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:37 +1000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 13:46 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 16:55 +1000
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:42 +0200
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-27 13:38 +0200
Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:32 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:36 +1000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 14:00 +0000
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 17:18 +0200
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 22:53 +0200
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:03 +1000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:17 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-27 15:18 +1000
Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-26 06:57 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:07 +1000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:21 +0000
Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-27 05:53 +0000
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:19 +0000
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:46 +0200
Re: Ebay hacked "BartC" <bc@freeuk.com> - 2014-05-24 20:54 +0100
Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 20:24 +0000
Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:35 +0000
Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-23 00:28 +0100
Re: Ebay hacked simple@machines.gopher - 2014-05-23 14:30 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 00:36 +1000
Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-24 13:34 +0200
Re: Ebay hacked mm0fmf <none@mailinator.com> - 2014-05-23 18:21 +0100
Re: Ebay hacked Tim Streater <timstreater@greenbee.net> - 2014-05-23 18:39 +0100
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:29 +1000
Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-23 21:57 +0000
Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:28 +1000
Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-26 15:27 +0100
Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 14:32 +0000
csiph-web