Re:Nobody Cares About Security
by mandelbrotwurst on Monday September 09, 2024 @12:53PM
(#41490505)
Is the idea that the attacker is brute forcing the login method and they are less likely to be successful if the input must be passed in an unexpected format?
Types where the constructor takes care of the rules and aborts if you pass it something stupid (like an empty string for a user name).
The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things.
` A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`.
This is stuff that must be done in the lower layers, to take advantage of how lazy people is. Do it for the most popular libraries and frameworks and we are talking about real impact.