The DMZ

tylerl

18:05

* Wrote a command-line utility to make it easier to bulk-change wordpress usernames and passwords

* Had to write it in PHP (cause Wordpress is PHP)

* Now I feel dirty

Lucas Kauffman

►

Iszi

18:48

I suppose this is one for the crypto guys.

#OneDrive is here, as is your chance to win 100 GB FREE storage. Solve the puzzle for details http://bit.ly/O5Yqex http://t.co/ciNyiyp4gd

Tweeted by onedrive on February 19, 2014 at 3:55 PM

Iszi

19:34

I have to fill out this form. Makes me feel really dirty.

For what it's worth, they are using HTTPS.

Rоry McCune

@Iszi have you tried accessing the site over HTTP to make sure they force the re-direct?

Iszi

@RоryMcCune The welcome page is HTTP, then they send you to HTTPS for sign up.

Rоry McCune

@Iszi not great then, but I suppose it could be worse...

Iszi

@RоryMcCune Interestingly, you can change the address of the sign-up page to HTTP and it will load just fine.

Rоry McCune

@Iszi d'oh

Iszi

19:47

Can't wait to test out the password recovery function.

Oh dear. It asks for your e-mail address and the button says "Send My Password".

Password reset function also allows username enumeration (though I'm not going to test for failed attempt lockout).

Oh, and the e-mail field for signup explicitly disallows apostrophes.

Rоry McCune

@Iszi that's not usually a good sign....

Iszi

Being that it's for a company-sponsored event, I was going to sign up with my business e-mail address. Now that I've taken a look around, that's not gonna happen.

Damn, this job makes you paranoid.

AJ Henderson

@Iszi it isn't paranoid if they are in fact out to get you

tylerl

@Iszi if you have an apostrophe in your email address, then you might want to consider changing your email address.

most "is this a valid email" filters will force [a-z0-9._+-]

Luc

20:15

Encryption is so leet snag.gy/IKi5y.jpg

Xander

@tylerl I think what @Iszi's getting at is that the restriction probably means that disallowing apostrophes is likely their chosen implementation for protecting against SQLi.

But you are correct, of course.

tylerl

@Xander possibly. But do they disallow "#" as well? And in that case, are they perhaps trying to guard against PHP comment injection?

Iszi

BTW: I checked and yeah, the password recovery actually does e-mail you your password in the clear. #FACEPALM

Luc

20:31

@tylerl I've seen ones rejecting my domain "lucb1e.com" for the number in it. They're usually not worth signing up for anyway, though.

Ladadadada

@Iszi Any length restrictions? Give them a 30-character password and get a 500 error back?

Iszi

@Ladadadada Like I said, I'm signing up for a company-sponsored activity. So I'm not really going to try much limit testing on the site. That said, if there is a length restriction, it's definitely >20.

tylerl

6

Iszi

@tylerl What's the latest on that, by the way? Someone own up to the breach and say how they did it yet?

tylerl

reminds me of that

@Iszi haven't heard anything further

Iszi

20:54

Didn't Troy actually show up here once?

AJ Henderson

109 rep to go....

Iszi

@AJHenderson What's that now? You want dowon-votes? Well, okay...

Xander

@Iszi Yup. He came to ask a question about certs and Chrome, IIRC, and we closed it as off-topic.

He figured it out himself in any case, I think.

Iszi

@Xander Drat. We'll probably never see him again

AJ Henderson

@Iszi nah, he stops by periodically

I've seen him stop by at least 3 or 4 times in the last year and a half

Iszi

21:02

Troy Hunt, Sydney, Australia

691 7 15

6 Questions, 2 Answers

Wow. We're his second-highest site by rep. The top is SO with 9k rep.

Hennes

21:23

@tylerl 2 year old tweet? And investigated by the Information Commissioner's Office? Still, what a clusterfuck

Tesco web security 'flaw' probed by UK data watchdog

Thousands hit in Tesco.com attack

Tesco said its security was "robust"

Iszi

@Hennes Oh, yeah. The myriad flaws in Tesco's security are old news. The breach is fairly recent though.

Hennes

I just heard about it today. So I admit it is news to me

Iszi

This reminds me: That site I was griping about earlier has one of those stupid "we're secure" padlock thingies too.

Hennes

Then again, I work at a place where username and password are identical and where the username is public information. :(

(and no, I, the user, can not change some of the passwords)

Iszi

@Hennes Wait, what?

Hennes

21:33

I best deny ever having said that. But yeah. Security is somewhat lacking

Gilles

22:14

0

Q: How can it be possible to have encrypted communication between a server and a client if the server has only a public key

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?

encryption server client-side protection

what's a good duplicate for that?

security.stackexchange.com/questions/20803/how-does-ssl-work is too technical, or is it ok?

Iszi

@Gilles Anything about the basics of SSL and/or public key cryptography should do.

Gilles

I went with security.stackexchange.com/questions/6290/…

security.stackexchange.com/questions/51892/… even quora is closing this question! quora.com/…

0

Q: TLS browser capability checker

Is there a web application that checks the TLS capabilities of the browser? At least supported protocols and versions certificates It should create a detailed report of the results. There're good tools for checking server configurations but same tools can not be used to check browser implemen...

web-apps security

^^^^ one for the bear

TildalWave

22:49

@Gilles I can't make any sense of his question not here and neither on Quora

I fear it's just some delusional sod, I mean, what has the supreme court got to do with "frenemies stalking anyone on the internet?" LOL

BTW I ate too many oranges yesterday, in case you're wondering, I don't recommend it :))

ManishEarth

@TildalWave There are days when I have survived on citrus fruits

Iszi

@TildalWave You didn't eat enough, if it was done yesterday and they're just now kicking in.

One afternoon, I had probably upwards of a dozen in one sitting. Was regretting it by that evening.

TildalWave

yeah, I'm not used to it and they were 1) really effin good 2) really effin strong

I prolly ate half the bucket

I could swear I'm a bit more orange today :))

Iszi

@TildalWave Like Deep Roy?

TildalWave

@Iszi jeez no not that much

I'd usually eat say up to 3 oranges per day the most, when they're good and in season ... but I got me one of those carrying buckets (IIRC over 6 kg) of Sicilian red oranges yesterday and prolly ate half of it

ManishEarth

23:22

Guys, the disabling of the autocomplete attribute by default has gotten through security review on Mozilla. Please leave a comment on the bug if you don't want this to happen. (@LucasKauffman)

copy

> ignore autocomplete="off" for the purposes of filling in saved passwords via the password manager

Sounds perfectly fine to me

ManishEarth

13

Q: Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password managers from working. These days sites like Yahoo Mail seem to do it as well because they feel t...

web-application web-browser html

The OWASP page gives a password field as an example, however the text talks of credit card fields. What do you think of overriding autocomplete=off for username and password fields only? — Manishearth Jan 26 at 21:25

copy

This means I can use my password manager to save passwords even if the field has autocomplete off, did I get that right?

ManishEarth

@copy yes

@copy two weeks ago I patched in a config option for overriding autocomplete=off, this bug is about making it the default

@Lucas said that a lot of banks use it, and he feels that they should be allowed to continue to use it for both credit card fields (obviously), and password fields (not so obvious)

copy

That's nice

Oh, I can see the problem

ManishEarth

23:31

exactly

Gilles

Not just banks. For example the author of the application where we submit holiday requests thought his app had to really really enforce username and password privacy

ManishEarth

@Gilles and that's where it gets annoying

Gilles

Meanwhile, Amazon stores everything

ManishEarth

yahoo mail also did it iirc

Iszi

23:54

Anyone else getting "this website does not supply identity information" on HTTPS Twitter? Was it always that way and I'm just now noticing it (shame on me), or is it recent (shame on them)?

Gilles

#worksforme

from France, in Chrome, says “identity verified”

Iszi

Try Firefox? Works for me in Chrome, too.

Certificate serial numbers in both browsers match. Upon further inspection, Firefox is also giving a mixed content warning.

ManishEarth

@Iszi Firefox Nightly isn't complaining

Transcript for