An encrypted ZIP file can have two correct passwords

Re:An encrypted ZIP file can have two correct passwords – he... by akira2501 on Sunday August 21, 2022 @07:18PM (#32545477)

I didn't probe it that deeply as it was just a single device I need to backdoor.. but Apache tomcat appears to suffer from this. The configuration format doesn't have a prefix for hashed passwords, so just using the hash as a plaintext password worked to get access to the devices "super admin" menu.

[ Parent | on HN ]

Re:An encrypted ZIP file can have two correct passwords – he... by modeless on Sunday August 21, 2022 @07:38PM (#32545614)

In Zoom's case this seems to be working as intended. Clearly you are intended to be able to join the meeting with only the hashed password, that's what the sharing URL feature is for. It's probably more of an obfuscation feature, so people don't file angry bugs about how Zoom URLs reveal the plaintext of their terrible reused password.

[ Parent | on HN ]