News for hackers. Stuff that matters.

A comment on Gitlab – Static passwords set during OmniAuth-based registration (CVE-2022-1162). Parent comment

Re:Gitlab – Static passwords set during OmniAuth-based regis... by dewey on Friday April 01, 2022 @01:48PM (#30881090)
> then attempts to bruteforce the password should find “12345678” within an hour

But only if there's no rate limiting or increasing timeouts for wrong passwords which in most cases exists.

[ Parent | on HN ]
Re:Gitlab – Static passwords set during OmniAuth-based regis... by NavinF on Friday April 01, 2022 @02:00PM (#30881269)
Right, but you can bypass that in a testing environment.
[ Parent | on HN ]
Re:Gitlab – Static passwords set during OmniAuth-based regis... by dewey on Friday April 01, 2022 @02:05PM (#30881341)
Which then opens you up to exactly that class of bugs that also caused this issue. Having test specific code and feature flags and then testing a tweaked version isn't really covering all the cases then.

Just like in this case where a hardcoded password was set to maybe log in through a test based on the naming "test_default".

[ Parent | on HN ]