News for hackers. Stuff that matters.

A comment on Ebay posts every character a user types into the password box. Parent comment

Re:Ebay posts every character a user types into the password... by jyounker on Wednesday June 29, 2016 @08:11AM (#12001097)
Ummm... you're assuming that eBay is using a standard web server configured in some default manner. It's far more likely that this is communication with a custom authentication server of some sort. (Where server means a very large collection of machines.)
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by pyre on Wednesday June 29, 2016 @08:30AM (#12001197)
It's likely that eBay's internal infrastructure has compensated for this, but it also seems like a potentially overlooked aspect of their system. Even if there are no server logs per se (unlikely), they might be sending request logging information to some sort of analytics server. Since these requests are internal, it's also possible that it's not SSL-protected meaning that people internally could eavesdrop on the requests.
[ Parent | on HN ]