The DMZ

belkarx

04:53

Wait is there an age req to be a mod bc I seem to remember that was mentioned but it's not in the moderator agreement

Thomas Weller

07:34

Hello everybody. Say I have a web application where I can access personal information about myself. There are links to go to the past 2 months. However, maniuplating URL parameters, I can access all time information. Which security risk category would that be?

nobody

07:45

All information about yourself? Or other people too?

fenixleon

Does anyone know of any resources that cover security issues with backporting?

Thomas Weller

@nobody: actually I have 2 issues. One is about others, that is probably A01:2021-Broken Access Control
The second is just information about myself, but to which I don't have access using links provided by the web app itself.

fenixleon

@ThomasWeller Assuming it's unauthorized, it could be classed as data leakage.

nobody

@ThomasWeller hmmm... I don't know the specifics of that webapp, but I don't see why this would be any significant risk here. Does the application have any reason to not let you access your old information?

Thomas Weller

@fenixleon: yes, that sounds plausible. Like M4: Unintended Data Leakage
https://owasp.org/www-project-mobile-top-10/2014-risks/m4-unintended-data-leakage

@nobody: that's something I don't know and can't judge about. It's about time accounting information. Actually I have access to that information for the current month, i.e. when I enter the data. On the last day of the month, I could save the information and thus keep an archive myself. So, basically it's information I already knew about and it's just a question of what I can remember or not.

fenixleon

08:04

@ThomasWeller Since you're using OWASP as your framework, you can map A3:2017-Sensitive Data Exposure - owasp.org/Top10

Thomas Weller

@fenixleon: ok, thanks. I will just enter it like that. Someone else will need to do a review and an evaluation anyway. I just don't like to be straight wrong ;-)

Thanks for your feedback, everyone. Have a nice day.

Fire Quacker

12:54

38

A: Is there a minimum age for Community Moderators on Stack Exchange?

TL;DR: Users have to be at least 18 to be a moderator on a Stack Exchange site. As of 2 December 2020 we established a policy requiring all moderators to be at least 18 years of age. Because the Moderator Agreement is considered a legal contract and minors can not legally be held by the agreemen...

It's not in the agreement itself but in the checkboxes to accept the agreement (which you can't see unless you're elected)

Catija

13:11

@FireQuacker It's also in the form to nominate. If you nominate in an election, there's a checkbox there telling you that you need to be 18 by the time the election ends. :)

MechMK1

27

Q: I insulted a professor by using an anti-Semitic slur in a department seminar, how bad is this?

I am in a research group in a French university in physics (I am a 1st year PhD student) and in a seminar in my university I used a slur against an Israeli professor, Professor X. I am from an Arab country which has conflicts with Israel. Professor X was trying to mock me or act over-smart but in...

@forest Congratulations on your mod role

nobody

13:30

@Catija A CM in the DMZ? Are we in trouble or something?

Catija

Nah, just felt I could be helpful.

Journeyman Geek

@nobody If nobody talked, nobody is in trouble. Capiche?

nobody

Ah, okay :) Your help is appreciated.

@JourneymanGeek Yes, for some values nobody.

Journeyman Geek

If somebody talked, anybody might be in trouble , and vice versa

nobody

Congrats @RoryAlsop for SEx.SE

How many diamonds do you have now?

Catija

13:38

HAHAHAHA Now @RoryAlsop is a mod on Sec.SE and SEx.SE... ... and I'm a teenager.

Rory Alsop

@Catija hahahahahahaha

@nobody 8 :-)

@Catija that wasn't the reason I stood, honest

Catija

I should hope not.

MechMK1

So many mods around

I better leave :D

Have a nice day everyone

Journeyman Geek

@MechMK1 WHERE?

(I mean, I'm always here)

nobody

@MechMK1 I'm going with you if you don't mind

Oh, he already left...

Catija

13:40

I'm not a mod. So it's OK.

nobody

You're a manager. Even worse

Rory Alsop

@JourneymanGeek this is the way

you are also everywhere

Journeyman Geek

@RoryAlsop This is the way

nobody

@RoryAlsop Are you the most highly decorated user network-wide yet?

Rory Alsop

@nobody No. I may hold the most diamonds, but I think the folks on Arts and Crafts have better decorative skills

3

@nobody and folks like @JourneymanGeek have more difficult diamonds

Journeyman Geek

13:46

@RoryAlsop Well - usually when SE blows something.

I spent my first week as a MSE mod moderating on my phone

there's days I need both screens to keep up :D

Rory Alsop

@JourneymanGeek Yes, thankfully modding SEx.SE shouldn't change my workflow

I know I couldn't be a mod on SO

Journeyman Geek

I don't know the subject matter well enough

ChocolateOverflow

14:19

Assuming there's a breach leaking plain text data (e.g. creds), with or without payment, on the dark web related to employees of the pentest target, would it be ok for the pentesters to use that data?

Rory Alsop

@ChocolateOverflow what does your contract with the target organisation cover?

MechMK1

14:34

Actually, I'm back

Oracle DB has a feature where they can "encrypt" the password in the connection string

Is there any way for me to decrypt that?

Rory Alsop

@MechMK1 if you have the decryption key, I'd be confident that you could :-)

MechMK1

@RoryAlsop I mean...does it actually really matter? The password is in the config file. somehow I have to be able to connect to the DB with that

So even if the DB then decrypts and checks it...like...the encrypted password is the password

Isn't it?

Fire Quacker

So you have the password but aren't sure how to encrypt it to get into the database?

MechMK1

No no

I have a config file

for a fat client

that specifies a connection string for an oracle db

and instead of saying "username=foo,password=bar" it says "usernamer=foo,encryptedpassword=AQAAAABFKSC/HAK..."

But I mean...it really shouldn't make a difference, right?

Fire Quacker

If it connects, it connects

nobody

14:44

@MechMK1 Are you sure the client isn't the one that has to decrypt it?

MechMK1

@nobody Then the fat client would need the key somewhere laying around

So it would make little difference, no?

nobody

Probably wouldn't

Unless its something like the key is only kept in memory or something

MechMK1

15:00

It has to be in the executable (or config file)

Unless it's one the user has to type in

But that's not in this application

So possessing the application, the user has everything he needs to connect to the DB

belkarx