Show HN: A time tracker that asks you every 10 min what you're doing

Re:Show HN: A time tracker that asks you every 10 min what y... by jomendoz on Tuesday August 06, 2019 @10:53AM (#20625665)

Please, do NOT sign up in this site until author fixes this noobish vulnerability:

When the sign up request is sent, it shows a S3 error not finding corresponding key. The true misdeed is requesting the resource with get and passing email and password as query parameters in the URL. Such a shame >-(

[ Parent | on HN ]

Re:Show HN: A time tracker that asks you every 10 min what y... by grepthisab on Tuesday August 06, 2019 @11:16AM (#20625883)

Isn't this pretty similar to basic auth? Passing credentials in plaintext but over TLS.

[ Parent | on HN ]

Re:Show HN: A time tracker that asks you every 10 min what y... by jomendoz on Tuesday August 06, 2019 @02:21PM (#20627921)

Yes. But URLs tent to be logged more than HTTP headers or payloads. Any L7 proxy can spit out requested paths and the password will be preserved in different places for long periods of time.

[ Parent | on HN ]

Re:Show HN: A time tracker that asks you every 10 min what y... by grepthisab on Wednesday August 07, 2019 @10:37AM (#20635058)

Ah, that makes sense. Thanks!

[ Parent | on HN ]

Re:Show HN: A time tracker that asks you every 10 min what y... by bucket2015 on Tuesday August 06, 2019 @11:35AM (#20626068)

Fixed.

[ Parent | on HN ]