News for hackers. Stuff that matters.

A comment on Skype vulnerability allowing hijacking of an account if you know just the email. Parent comment

Re:Skype vulnerability allowing hijacking of an account if y... by entropy_ on Wednesday November 14, 2012 @05:31AM (#4782805)
It's not a client-side fix. Just stop the server from sending the token/link to the clients. Sure, that might degrade the client experience a bit(assuming that the client isn't just displaying a webview in which case no degradation would occur) but it would fix the problem for now.

Later on you can take your time rolling out a client fix if it's required, but a hotfix server-side is entirely possible, there's no excuse keeping this vulnerability possible when it's been made this public(step by step instructions to hack someone's account, with screenshots!) especially since you were contacted privately about it ~3 months ago.

[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by JabavuAdams on Wednesday November 14, 2012 @07:45AM (#4783081)
Right. There's one developer at Skype who can just do that and push it to production, without talking to anyone else, or getting approval from anyone else.

Be realistic. If two people need to talk about it, it's going to take longer than 2 minutes.

[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by entropy_ on Wednesday November 14, 2012 @08:11AM (#4783138)
Longer than two minutes, definitely! More than 2 hours to investigate and fix? very doubtful. 3 months? That's a bit much...
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by se85 on Wednesday November 14, 2012 @01:17PM (#4784603)
I see your not familiar with the nature of code deployments and everything that has to happen beforehand. ;)

The two hours were most likely spent on office politics as opposed to fixing the problem. I'm surprised it wasn't > 5 hours to be honest.

[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by entropy_ on Wednesday November 14, 2012 @05:42PM (#4786010)
Given your description I'm sure I'm lucky I'm not familiar with that. I've never worked at any place that has > 40 employees. If I can manage, I hope never to have to.
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by se85 on Wednesday November 14, 2012 @09:18PM (#4786736)
Yeah, there's no doubt it sucks but so can working for smaller organisations. It's all about the people your working with. The bigger the company, the more deadwood you likely have to work with.
[ Parent | on HN ]