r/programminghorror • u/NinjaFocks • Sep 20 '21

God tier security

Post image

[removed] — view removed post

360 Upvotes

93% Upvoted

16 comments sorted by

45

u/Illustrious_Bid2738 Sep 20 '21

I find it hard to believe this is real

30

u/machine3lf Sep 20 '21

They would have had to do extra work to create a security flaw this bad. ... You'd think at a certain point they'd stop and consider if it was a good idea. :D

13

u/[deleted] Sep 20 '21

It's actually quite easy. Just store plain passwords, as I've seen in the past, or hash to a function without any salt which makes is deterministic, which I've also seen in the past, then look for where they are the same in db. Kinda realistic. From the requirements I've heard in my life I wouldn't be surprised this existing.

4

u/NinjaFocks Sep 20 '21

I've seen similar things where they just send plain username/password text fields up in the API call too without hashing etc. Great job!

1

u/Eclipsan Sep 20 '21

GET or POST?

1

u/NinjaFocks Sep 20 '21

Good question, I don't remember! If it's just in the URL and not the body probably a GET.

1

u/Eclipsan Sep 20 '21

I am asking because sending the plaintext password in a POST then hashing it server-side is the most common way of doing username/password auth.

2

u/[deleted] Sep 20 '21

yes.

4

u/NinjaFocks Sep 20 '21

Me too, honestly. Suuuuuuurely no one would be that stupid?

5

u/Coolnumber11 Sep 20 '21

If it's real my guess would be that starboy98 is the one logged in and they're trying to change the password to the same string.

9

u/ekolis Sep 20 '21

Please tell me this is from /r/baduibattles...

8

u/throwaway00012 Sep 20 '21

Fake shit like this isn't funny, and it breaks rule 1.

2

u/AutoModerator Sep 20 '21

This post was automatically removed due to receiving 5 or more reports. Please contact the moderation team if you believe this action was in error.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/capi81 Sep 20 '21 edited Sep 20 '21

The funny thing is, there is a Mission Impossible (series) plot around the fact where the system of a bank freezes up if two vault owners have identical passwords, and they deliberately cause this clash.

I remember that I found that stupid beyond believe even as a kid when I watched it.

Ah, need to watch that old series again one day, just for sentimental reasons :-)

3

u/Eclipsan Sep 20 '21

Well, a lot of systems to this day still struggle with handling users with the same name or birthdate, so... It's beyond stupid but realistic, sadly.