Code Camp Security Problems

I am proposing a talk at Silicon Valley Code Camp about Web application security problems.

But now I need to modify the talk because I ran into a lot of outrageous problems on the Code Camp website itself.

Insecure Password Retrieval

I forgot my password, so I used the password retrieval system.

They apologized for not sending me my old password in plaintext, which apparently is something they think I would want (WHAT?).

Plaintext Login

Welcome to 1998! At the Code Camp website, I logged in with my new password, which was sent to the server unencrypted:

Of course, that password can only be used once, right? But the site did not prompt me to change it.

Hmmm... I logged out and logged in again with that same password. More evil.

I decided to change my password anyway, although it seems rather pointless.

The password change system doesn't ask me for the old password at all, and sends two copies of my new password to the server in plaintext.

It also sends my email address, name, and phone number in plaintext.


Last modified: 4-30-14 3 pm