Re: Ebay hacked

From	Lewis <g.kreme@gmail.com.dontsendmecopies>
Newsgroups	comp.misc
Subject	Re: Ebay hacked
Date	2014-05-27 05:53 +0000
Organization	Miskatonic U
Message-ID	<slrnlo8a32.1tv3.g.kreme@amelia.local> (permalink)
References	(2 earlier) <vg3oayn5gh3.fsf@coffee.modeemi.fi> <llqipl$59h$1@dont-email.me> <budrskFf0vtU2@mid.individual.net> <slrnlo5pej.196k.g.kreme@amelia.local> <bug7grFua32U1@mid.individual.net>

Show all headers | View raw

In message <bug7grFua32U1@mid.individual.net> 
  Sylvia Else <sylvia@not.at.this.address> wrote:
> On 26/05/2014 4:57 PM, Lewis wrote:
>> In message <budrskFf0vtU2@mid.individual.net>
>>    Sylvia Else <sylvia@not.at.this.address> wrote:
>>> On 25/05/2014 2:53 AM, Rich wrote:
>>
>>>>
>>>>     "Spaces and certain symbols (< >[ ]//) are not allowed in password."
>>>>
>>>> A properly designed password storage (using a hashing function such as
>>>> bcrypt or scrypt) does not care what symbols are in the password.
>>>>
>>>> Caring about specific symbols in the password implies they are not
>>>> following proper password storage models.
>>>>
>>
>>> I wonder where the restriction is enforced - both on the client and at
>>> the server, or just in the client? How many here would be surprised if
>>> it were the latter?
>>
>> Are you suggesting that web browsers don't allow certain characters in
>> text input fields? I've never encountered that in any browser.
>>

> No. But Javascript can be used to impose such a restriction, though it 
> obviously doesn't prevent the user from modifying the script so as to 
> send a supposedly prohibited character to the server.

Ah, I see.

> I'd like to think that no developer would be so naive as to rely on 
> client side validation, but if I did think so, the evidence would show 
> me to be wrong.

Yah, I'm pretty sure you're wrong.

Maybe next time I run into one of those stupid forms I'll see about
injecting little Bobby Tables.

<https://xkcd.com/327/>

-- 
The Force can have a strong influence on a weak mind.

Thread

Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-22 17:38 +1000
  Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-22 13:35 +0000
    Re: Ebay hacked Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-05-24 14:32 +0100
  Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-22 15:59 +0000
    Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-23 17:06 +0300
      Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:13 +0000
        Re: Ebay hacked Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-24 20:45 +0100
          Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:33 +1000
            Re: Ebay hacked Jerry Peters <jerry@example.invalid> - 2014-05-25 20:19 +0000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 21:50 +0000
      Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:53 +0000
        Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-24 21:12 +0300
          Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 18:33 +0000
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:37 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 13:46 +0000
                Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 16:55 +1000
                Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:42 +0200
          Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-27 13:38 +0200
        Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:32 +0000
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:36 +1000
          Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 14:00 +0000
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 17:18 +0200
          Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 22:53 +0200
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:03 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:17 +0000
                Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-27 15:18 +1000
          Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-26 06:57 +0000
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:07 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:21 +0000
              Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-27 05:53 +0000
            Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:19 +0000
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:46 +0200
      Re: Ebay hacked "BartC" <bc@freeuk.com> - 2014-05-24 20:54 +0100
        Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 20:24 +0000
        Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:35 +0000
  Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-23 00:28 +0100
    Re: Ebay hacked simple@machines.gopher - 2014-05-23 14:30 +0000
      Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 00:36 +1000
        Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-24 13:34 +0200
    Re: Ebay hacked mm0fmf <none@mailinator.com> - 2014-05-23 18:21 +0100
      Re: Ebay hacked Tim Streater <timstreater@greenbee.net> - 2014-05-23 18:39 +0100
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:29 +1000
      Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-23 21:57 +0000
      Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:28 +1000
    Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-26 15:27 +0100
      Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 14:32 +0000

csiph-web