News for hackers. Stuff that matters.

A comment on Safari tries to fill username. Parent comment

Re:Safari tries to fill username by AlfeG on Friday May 28, 2021 @11:49AM (#27316864)
Some hired "pentesters" found in our Asp.Net application that "Connection to the prod database is established before the user credentials have been validated.". They even insist that this is come from some ISO security guidelines.

Cheese, this one line in their report causes around 3 hours of meetings with around 10-20 people on them... and there were a lot of lines like this.

[ Parent | on HN ]
Re:Safari tries to fill username by sipos on Friday May 28, 2021 @02:49PM (#27319111)
This is the DB that contains the usernames and (hashed) passwords right? What do they expect? That you have a separate DB for authentication from everything else? What does that achieve? If you DoS the auth DB, you still DoS the application in this scenario.
[ Parent | on HN ]
Re:Safari tries to fill username by eurasiantiger on Friday May 28, 2021 @06:14PM (#27321154)
The application has a much larger attack surface than the auth/user system, so it makes sense to store PII separately.
[ Parent | on HN ]
Re:Safari tries to fill username by AlfeG on Saturday May 29, 2021 @05:11AM (#27324000)
Actually yes.

They try to sell us external/internal Auth service, similar to KeyCloack with their support. What pentesters want to achieve is not improved security, but to sell their services as DevOps and developers. This were not what we expected from pentesting.

[ Parent | on HN ]