| ||
Wed 2024-11-20
Tue 2024-11-19
Mon 2024-11-18
Sun 2024-11-17
Love, Acceptance, and Screeching Modems Sat 2024-11-16
Fri 2024-11-15
Search
Archives
2023
12 11 10 09 08 07 06 05 04 03 02 01
2022
2021
2020
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
One good site
MDN
Nelson Minar
Blog licensed under a Creative Commons License
|
Another
serious hack
of Microsoft Passport.
The flaw allowed a single Web address--or URL--to be used to request a
password reset from the Passport servers. The URL contains the e-mail
address of the account to be changed and the address where the
attacker would like to have the reset message sent. By entering the
single line into a Web browser an attacker can cause the Passport
servers to return a link that allows an account's password to be
reset. By following the link returned in the message, the attacker can
change the password for the victim's account.
Bugs like this are incredibly common, usually not worth reporting. But Passport is different. Passport wants to be the single trusted repository of personal data, all your eggs in one basket. I worry they don't have a fundamental systems security model to make that safe. This isn't the first time Passport has been hacked, either. |
|
