The Great Cannon has been deployed again

Re:The Great Cannon has been deployed again by unethical_ban on Friday December 06, 2019 @04:36PM (#21726216)

I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test.

Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right?

That isn't all. My password, they said, was "password1". They silently stripped out the special character.

I just about flipped a table at how security-shallow people who build websites can be.

[ Parent | on HN ]

Re:The Great Cannon has been deployed again by mgerdts on Friday December 06, 2019 @05:10PM (#21726500)

Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password?

If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.

[ Parent | on HN ]

Re:The Great Cannon has been deployed again by unethical_ban on Saturday December 07, 2019 @11:13AM (#21730978)

I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be.

And if they did strip it out, that is bad. That's the point.

[ Parent | on HN ]