Chaging password in work

cluelessPHP

So I'm still packing boxes in Amazon, today I had to change my password. They have a token in an input field marked as TOKEN in the form, is it just me or does that seem just completely wrong?:o

laserlight

It might just be a token gesture to satisfy management somewhere. The real token could be elsewhere :p

dalecosp

It depends on its content. First off, a visible form field marked "token"? That would be odd. But what's wrong with calling a hidden field token if that's what it is? It should be randomly-generated and hard for attackers to (successfully) duplicate. If you're argument is that it should be called something other than what it is, isn't that the "security by obscurity" paradigm that we all warn other people about?

cluelessPHP

Hehe I like this idea "Yes yes Mr.manager look you have a token the bad people can't get you" 😃

Well apparently the 5 token deletes after two hours, also I remember someone here saying don't use hidden fields like that (laserlight maybe nogdog, or you even dalecosp ) , anyway it wasn't even a hidden input it was a text field anyone could see the token :p

dalecosp

cluelessPHP;11058063 wrote:
Hehe I like this idea "Yes yes Mr.manager look you have a token the bad people can't get you" 😃

Well apparently the 5 token deletes after two hours, also I remember someone here saying don't use hidden fields like that (laserlight maybe nogdog, or you even dalecosp ) , anyway it wasn't even a hidden input it was a text field anyone could see the token :p

Don't think it was me. The main objections I've seen were caused by the fact that NO ONE had implemented a server-side check! :eek:

cluelessPHP

I looked at an old thread it was maxxd and sneakyimp although lasterlight was asking if i had covered csrf at the time, it's an interesting article haven't read it all yet, lunch time in work we only get 30 mins :glare: