Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 | 5 
383 posts

Ultimate Geek


  #1089013 15-Jul-2014 08:32
Send private message

joker97: but whatever the password, you'd still need a username to see another person's account! is that not true?

it's not like you enter the masterpassword and you get to see all kinds of stuff - unless the username was also a MasterUSER ... 


Yeah so not only were the number of duplicate passwords small but this guy had to accidentally typo his username to one that just happened to be one of the effected usernames with the same password. The chances of this occurring must be incredibly slim.




Please note: I have a professional bias towards Vodafone.

563 posts

Ultimate Geek


  #1089016 15-Jul-2014 08:35
Send private message

Jaxar:
joker97: but whatever the password, you'd still need a username to see another person's account! is that not true?

it's not like you enter the masterpassword and you get to see all kinds of stuff - unless the username was also a MasterUSER ... 


Yeah so not only were the number of duplicate passwords small but this guy had to accidentally typo his username to one that just happened to be one of the effected usernames with the same password. The chances of this occurring must be incredibly slim.


Don't forget the possiblity that the deliberately went out to try and find other effected usernames...

 
 
 
 


88 posts

Master Geek


  #1089058 15-Jul-2014 09:20
Send private message

I didn't think I'd have to spell it out.. But it's easy to harvest email addresses, which are also often user names, then try those. It would be fairly easy to write a script to test a thousand user names with one password on a page.

383 posts

Ultimate Geek


  #1089119 15-Jul-2014 10:11
Send private message

b0rg: I didn't think I'd have to spell it out.. But it's easy to harvest email addresses, which are also often user names, then try those. It would be fairly easy to write a script to test a thousand user names with one password on a page.


Completely valid point when speaking about security in general. This wasn't some sort of deliberate attack however this was a customer who stumbled across it.
As you said though it is a basic authentication and we would not need an issue with duplicate passwords for it to be vulnerable to the kind of brute force attack you are describing which is why companies don't actually display  full credit card numbers in an account screen like the article suggested it did.




Please note: I have a professional bias towards Vodafone.

Human
2971 posts

Uber Geek

Subscriber

  #1089373 15-Jul-2014 16:42
Send private message

coffeebaron:
joker97: You sure you did? 123456 still works

This is bigger and more serious than first thought. There must be a master master password. This can only be fixed now with a master filter.


I think you are both wrong - 00000000 is actually the master password. [ref]





Mad Scientist
21796 posts

Uber Geek

Trusted
Lifetime subscriber

  #1089400 15-Jul-2014 17:33
Send private message

surely not?!!




Involuntary autocorrect in operation on mobile device. Apologies in advance.


1 | 2 | 3 | 4 | 5 
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

New online learning platform for kids stuck at home during COVID-19 lockdown
Posted 26-Mar-2020 21:35


New 5G Nokia smartphone unveiled as portfolio expands
Posted 26-Mar-2020 17:11


D-Link ANZ launches wireless AC1200 4G LTE router
Posted 26-Mar-2020 16:32


Ring introduces two new video doorbells and new pre-roll technology
Posted 17-Mar-2020 16:59


OPPO uncovers flagship Find X2 Pro smartphone
Posted 17-Mar-2020 16:54


D-Link COVR-2202 mesh Wi-Fi system now protected by McAfee
Posted 17-Mar-2020 16:00


Spark Sport opens its platform up to all New Zealanders at no charge
Posted 17-Mar-2020 10:04


Spark launches 5G Starter Fund
Posted 8-Mar-2020 19:19


TRENDnet launches high-performance WiFi Mesh Router System
Posted 5-Mar-2020 08:48


Sony boosts full-frame lens line-up with introduction of FE 20mm F1.8 G large-aperture ultra-wide-angle prime Lens
Posted 5-Mar-2020 08:44


Vector and Spark teamed up on smart metering initiative
Posted 5-Mar-2020 08:42


Schneider Electric launches new PDL Pro Series designed specifically for the commercial building market
Posted 5-Mar-2020 08:39


Kiwi app Pedigree DentaStix Studios uses pet images to counter impact of negative social media Content
Posted 5-Mar-2020 08:32


Samsung expands to New Zealand in 5G Networks Deal with Spark
Posted 5-Mar-2020 08:17


New Vodafone mobile data plans with unlimited data
Posted 26-Feb-2020 06:55



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.