News for hackers. Stuff that matters.

A comment on Reporter who told Missouri officials of website flaw did 'nothing out of line'. Parent comment

Re:Reporter who told Missouri officials of website flaw did ... by tyingq on Wednesday November 03, 2021 @05:27PM (#29100494)
They were. It was the _VIEWSTATE thing that ASP.NET sticks into pages. The developers put the full SSN into the _VIEWSTATE object, which is base64 encoded into the pages.

See https://news.ycombinator.com/item?id=28992667

There's a good comment there that the Microsoft ASP.NET help pages specifically call out an SSN as a terrible thing to put into _VIEWSTATE :)

[ Parent | on HN ]

There are no comments on this comment yet.