News for hackers. Stuff that matters.

A comment on Heroku resetting passwords for “a portion” of their users immediately. Parent comment

Re:Heroku resetting passwords for “a portion” of their users... by tialaramex on Wednesday May 04, 2022 @03:52AM (#31257839)
Right. If you're on top of things then using plain HTTP links here didn't make anything worse, but if you aren't it's yet another unnecessary gift to bad guys because it's yet another opportunity for customers to get phished.
[ Parent | on HN ]
Re:Heroku resetting passwords for “a portion” of their users... by Froogo on Wednesday May 04, 2022 @05:51AM (#31258437)
Sorry, meant if the end user's network was compromised, not the server's.

Whether or not you're on top of your game, HTTP leaves you vulnerable to MITM attacks[0]. So this would leave the end user vulnerable to any of these attacks even assuming Heroku has everything else perfect.

[0] https://en.wikipedia.org/wiki/Man-in-the-middle_attack

[ Parent | on HN ]