There Was Not a Breach; There Was a Blog
Talkat CAST 2014 · on Wednesday, 2014-08-13· at 12:45· 10th fl Rosenthal Pavillion, Kimmel Center for University Life·
summary
A user with browser developer tools on uncovers a chain of flaws: account existence leaks via error responses, cookies over 4KB breaking logins, full backend JSON (including paystub and partial SSNs) returned to the browser, and password reset codes displayed in the page and sent to third parties (Pingdom, DoubleClick). Many issues are automatable; fixes arrive incrementally after press contact. Notable context: 8.6 million unique visitors in three days and password reset codes never expire initially.
AI-written summary · about
chapters (10)
- 0:00Start
- 13:37Choking on cookies
- 14:47Exposes Email Addresses
- 19:10Poor security question options
- 22:14Stack traces
- 24:26Password reset codes revealed
- 25:02Username and password reset code sent via email
- 25:54Unchanging password reset codes
- 28:34Discloses security questions that go with a name and email address
- 29:21Put the pieces together
related talks
59mInside the Breach: Secrets Exposed
28mLearning from High Profile Failures
09mI thought we did things right until I went looking - Security errors in Norwegian websites
46mDesigning Like a Hacker
48mLessons From Billions of Breached Records
57mLessons From Billions of Breached Records
46mKeynote: Lessons From 11 Billion Breached Records
40m"It Me": Under the Hood of Web Authentication