new technique to reply testers by program admin :D lol lol #copy #paste #markall #sendall #hackerone Hi there, We received a few hundred reports and most of them were not applicable for our vulnerability program. I am summarizing the most common reported issues (some of them were sent more than 30 times). -Brute force on out login/forgot password page: We have a non aggressive policy there and we do allow multiple failed logins. If you try too many times , you will be blocked. -Session issues. We do allow multiple sessions opened across multiple browsers. We do not invalidate immediately after a password reset, but it expires automatically a bit after. -User enumeration: Same as the brute force. -Password policy: Yes, we do accept small passwords or the user to reuse them. -Our CSRF tokens are checked only on critical pieces that can affect the user/account state. On our search or scan page, we do not use them. It is ok. -SPF: It is known and we need to keep it like that for now. -Trace method: Yes, it is enabled on some servers. If you can show a POC on how it can be misused to compromise our servers, we will re-look at it. -Missing security headers. We do not consider them a vulnerability. They are hardening/security options and our critical servers have them enabled. Thanks for sending the report :) We appreciate the testing!
Posted on: Thu, 07 Aug 2014 14:12:53 +0000
Trending Topics
Recently Viewed Topics
© 2015