News for hackers. Stuff that matters.

A comment on Slack was hacked. Parent comment

Re:Slack was hacked by homakov on Friday March 27, 2015 @06:51PM (#9279558)
The parent meant "This probably could've been prevented by disallowing non-number inputs" in SDK libraries. Yes, if SDK would cast everything to digits it wouldn't be possible. It is also quite obvious security-in-depth for a 2FA API. Now they do it.

*HomAkov

[ Parent | on HN ]
Re:Slack was hacked by yellowapple on Monday March 30, 2015 @04:39PM (#9292421)
Or even just input validation on the form itself before passing on to the API, which is more of what I was getting at. I don't know about the details of Authy's setup, but I know that AJAX (for example) supports enforcement of specific value types in text fields.

Basically, the form itself could have (and maybe even should have) required numeric-only values, seeing as Authy's codes are either 6 or 7 digits long and contain no alphabetical or special characters.

[ Parent | on HN ]
Re:Slack was hacked by zaroth on Friday March 27, 2015 @08:10PM (#9279863)
:-( Sorry, typo. And HN won't let me edit now, grrr!
[ Parent | on HN ]