Re:“We found PayPal vulnerabilities and PayPal punished us f...
by SpicyLemonZest on Monday February 24, 2020 @02:44PM
(#22407639)
It's analogous to the systems that make your password show up as dots when you type it in. The security model isn't affected at all - dedicated attackers can "break the barrier" by just looking at your keyboard instead - but it significantly mitigates harm by making certain low-effort attacks harder to perform.
[ Parent
| on HN ]
Re:“We found PayPal vulnerabilities and PayPal punished us f...
by Dylan16807 on Monday February 24, 2020 @05:25PM
(#22409080)
A not-for-sure harm mitigation as part of defense in depth is a great thing to put in a security model.
But with the flaw here, the effectiveness drops to zero. The "making certain attacks harder to perform" is basically gone in the scenario where someone is buying a bunch of credentials. That's not good!