Re: PayPal security flaw

From: Barry Margolin (barmar_at_alum.mit.edu)
Date: 12/20/03

  • Next message: Ives Steglich: "Re: PayPal security flaw" 
    Date: Sat, 20 Dec 2003 05:38:03 GMT

    In article <m0ad5o3hbk.fsf@rcn.com>, comphelp@toddh.net (Todd H.)
    wrote:

    > True, but it doesn't excuse the poor coding practice if the page is
    > coded as the poster reports. There's no reason the password should
    > ever be stuck in a hidden form unhashed.

    Why does it matter that it's unhashed? Even if it's hashed, someone can
    copy it and send it in another browser session.

    Unless you want to make the user go through the password entry page
    again, the authentication info has to be saved on the client machine
    somewhere. It could be put in a cookie rather than a hidden field, but
    most browsers have a way to view all the cookies so that wouldn't really
    be any more protected. 

    -- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
  • Next message: Ives Steglich: "Re: PayPal security flaw"

    Relevant Pages

    • Re: PhpMyAdmin multi user install troubles, help needed...
      ... > know matter how much I read and look around, ... > permission checks and a few changes, restarting the server, deleting ... > I used the create_tables.sql in the scripts folder chose to use cookie ... > permissions on the mysql db, made certain that the config.inc.php file ...
      (comp.lang.php)
    • Re: Please check my auth login script
      ... cookie so that they dont have to log in every browser session. ... I'd hate to store plain passwords in cookies at the users computer, which not only usually are stored plainly on the HD there, but are also send on _every_ request. ... I usually create a hash unrelated to user/pass details, and store that as valid for that user, if that's to much you could encrypt a pass + a secret using some of the available encryption techniques used in PHP. ...
      (comp.lang.php)
    • Re: Cant clear www.t-mobile.com from my Ctrl-O funtion in IE6
      ... the culprit of this ONE piece of history stuck in the Ctrl-O window? ... And what is it with t-mobile.com's site that only their cookie (or ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • Disappearing cookies after login.aspx
      ... authentication cookie is present in the Context object, ... IIS 5.0 ... IE 6 Browser session on localhost. ... IIS wasn't there on the initial install. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: COOKIE EXPIRATION TIME
      ... It may be built into the expires property to treat the date ... Why does it matter? ... >> then no matter how often a user might visit our site, their cookie ... sliding expirations are how it is done. ...
      (microsoft.public.dotnet.framework.aspnet)