582
Uh oh, somebody's not following best practices, that's a paddlin (thelemmy.club)
submitted 1 year ago by to c/cybersecuritymemes@lemmy.world
106 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 year ago (7 children)

Username/password validation should happen entirely server-side, with as little information as possible provided to the client

💯

It's recommended practice to not even tell them which half of the username/password combination failed upon authentication failures.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 year ago (6 children)

    It is a password reset from. The username has already be confirmed in a previous step

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 year ago (5 children)

    That still doesn't make it good practice to send the old password (hashed or not) to the client.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 year ago (4 children)

    You are making an unfounded assumption that the password is sent to the client which does the check and then shows the message rather than the server doing the check and responding with the message back to the client.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 year ago (3 children)

    Nah I'm not, look above. There's a way to do this that isn't terrible. I just kinda assume that they aren't doing it properly because I've worked in software for decades.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    No one is reimplementing their hashing algorithm in JavaScript. Doesn't matter how many decades in the industry you have, that's a silly assumption.

    The parts of security here that involve best practices are invisible to the user. Things such as salting which many do not do but also how they handle the reset token which many do not think about.

    However, none of that makes a good meme for people cosplaying cyber security gurus.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    Of course they wouldn't implement it themselves, that's what the wonderful world of npm is for. /s

    The software I've worked in is full of bizarre, dangerous junk. I used to assume that people did things at least the easier way if not the right way. Now, I expect them to do the dumbest, wrongest most esoteric thing possible and I'm often right.

    anecdote

    I once worked with a person that was essentially maintaining a series of statically compiled hashmaps by hand instead of, you know, doing the obvious and externalizing the fucking thing into a database table. The insane bastard even sat there incrementing the initial collection sizes when he got requests to add in new data.

  • permalink
  • fedilink
  • source
  • parent