Ehh their engineering simply seems to be subpar. I’ve read some of the CVEs and if they followed best practices the issues should’ve never happened. It doesn’t inspire confidence.
I read some of the discussion over CVE-2023-7028. It sounds like they were reading a list of emails for password reset and if one matched the account they sent the reset email to all of them.
In my mind it is an extremely low bar that programmers not mix unauthorized input with account data. It simply should not have been possible to send an account secret to anything other than emails present in the database, full stop.
IDK, I appreciate the transparency and I would have been safe from that attack because I always use 2FA. But this is not a viable product for hosting code if their coding practices allow something like that through.
Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.
Ehh their engineering simply seems to be subpar. I’ve read some of the CVEs and if they followed best practices the issues should’ve never happened. It doesn’t inspire confidence.
I read some of the discussion over CVE-2023-7028. It sounds like they were reading a list of emails for password reset and if one matched the account they sent the reset email to all of them.
In my mind it is an extremely low bar that programmers not mix unauthorized input with account data. It simply should not have been possible to send an account secret to anything other than emails present in the database, full stop.
IDK, I appreciate the transparency and I would have been safe from that attack because I always use 2FA. But this is not a viable product for hosting code if their coding practices allow something like that through.
Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.