News for hackers. Stuff that matters.
Re:A digital skeleton key to access any website by walterbell on Saturday May 09, 2015 @05:13PM (#9517703)
Is the author proposing an open-source tool for registration automation/scraping, which would compete with LastPass, 1Password, etc? Or open-source infrastructure that could be used by all such services?
Re:A digital skeleton key to access any website by dogma1138 on Saturday May 09, 2015 @07:29PM (#9518076)
Well if it's a service then it isn't really different than most SSO providers out there. Yes it's technically different but the UX is virtually the same (and even easier with an SSO). You sign up once manually, then have to make several easy steps usually revolving just authorizing the 3rd party application to use your account.

Now i understand why many sites don't want to use SSO's, they lose control over their user base and get much less information from a registration via SSO than they would via their own registration form, and always the SSO providers (e.g. Twitter and LinkedIn) can always say you know what we don't want to provide that service any more, and in many cases you can be left with no ability to recover a large part of your user base.

That said I haven't seen many sites that Chrome cannot populate virtually their entire sign up page from memory, and like most stuff in Chrome it's also (can be) shared between devices as long as you are signed into one. Heck not that i would advise it but Chrome can even store your credit card number "securely" although that option i believe does not replicate between devices (never used it myself, not crazy:)).

Yes sign up processes can be annoying, especially when they obviously unnecessary, but from experiences the sites that put everything behind a signup wall rarely have much content to offer in the first place, since sites that actually want to monetize their user based tend to have very easy signups in order to reduce drop out rate. Heck just look at payday loaners, their sign up is as short as possible to get some info about you for a credit check and that's it, they don't want people to drop off before they get a loan and every step increases the chance that they'll figure out that taking one at 123514% APR isn't the best solution for their financial shortcomings.

Re:A digital skeleton key to access any website by tlrobinson on Saturday May 09, 2015 @10:49PM (#9518595)
"Heck not that i would advise it but Chrome can even store your credit card number "securely" although that option i believe does not replicate between devices (never used it myself, not crazy:))."

If my OS or Chrome is compromised I have bigger things to worry about than my credit card number, for which charges can easily be reversed...

Re:A digital skeleton key to access any website by dogma1138 on Saturday May 09, 2015 @11:13PM (#9518648)
Yes, but there's a compromise and a compromise, say there is a bug in Chrome that allows some one to exploit it in order to dump all of the auto-complete history including your CC but nothing else. Not everything results in a persistent exploitation of a system.

And even in such cases when the exploitation is persistent it's still a question of how much can they get and in what time window since you might detect it and remediate the situation.

I've seen some sneaky tactics that some sites used to get details from auto complete functions of browsers, yes chrome asks you if you want to submit that data, and asks you specifically for your CC but if you mask some fields such as address and phone number (Chrome detects if it's hidden, and to some extent when its not visible due to other factors so it needs to be just cleverly disguised in rendering) when some one just auto-fills say their email and username it might also leak personal information, and if people are not too careful also they're payment data (which i believe Chrome only auto-fills on sites you visited before, and on secure connections).

I personally only have to input my CC details online every couple of months since i use PayPal or Amazon Checkout for about 90-95% of my purchases, so i rather not have my CC data stored on my machine if i can avoid it. Yes if it's compromised they can eventually get it, but it's still better than it being stored in a place where every malware on the planet knows to look for it.

Re:A digital skeleton key to access any website by signaler on Saturday May 09, 2015 @05:26PM (#9517745)
Hey. Author here. Yes the tool would be open source and automate the process of registration. Alongside registration, it will borrow ideas from bugmenot where logins are ranked according to whether they work or not. The only difference being that machine learning and other means are used to rank instead of an upvote system which is mostly unreliable.

Keep in mind, there are inherent problems like T.O.S breaching so the tool would have to deal with them the right way, and through the right channels. Perhaps a standard could be implemented and sites could 'opt in' to having the skeleton key used on their site. So yeah - like open source infrastructure too.

Re:A digital skeleton key to access any website by icebraining on Saturday May 09, 2015 @05:47PM (#9517812)
Would the proposed system use shared accounts, or automated new account registration for the user?

If the former, I think the opt-in is a dead end. If the websites thought that was good for them, they'd enable anonymous use, and it even might be illegal for them to cooperate (e.g. they would be breaking COPPA by offering a way for under-13 to use the site without following the proper steps).

Re:A digital skeleton key to access any website by signaler on Saturday May 09, 2015 @06:04PM (#9517870)
It would use both shared accounts, and auto registration, which depend on how complex the registration system is and what requirements it has. For example, on sites which have lots of traffic it is preferable to have a swarm of newly registered accounts arriving all the time because of unreliable users of the account deleting it, changing the password etc. On less traffic'd sites it would be preferable to have a few small accounts. I've observed this on bugmenot...
Re:A digital skeleton key to access any website by whyleyc on Saturday May 09, 2015 @05:58PM (#9517853)
After reading the original post it's still not clear to me why you would want this tool - Would you mind explaining the motivation behind it ?

As an end-user of sites I don't find registration a particularly onerous or annoying problem - signup, login, move along.

As an operator of a few different sites the concept of users spamming the crap out of my registration system using automation is an annoyance I could do without.

Re:A digital skeleton key to access any website by signaler on Saturday May 09, 2015 @06:15PM (#9517895)
Seems more like an edge case. If you look at bugmenot, the system works beautifully, and I am still amazed at how well it works, and how long the logins work despite the system being a bit sneaky and breaching the T.O.S on sites where multiple accounts and account sharing are forbidden. I wouldn't propose the system if it was going to harm the web in some way, and I said before that we can standardize it so that webmasters can allow a skeleton key to be used. Sort of like try-before-you-buy mechanism. Most sites do not have the luxury of some anonymous-user function where we can login instantly and start seeing walled garden information