:sigh: another day, another website that hardcodes their @oauth_... • Aaron Parecki

72°F

:sigh: another day, another website that hardcodes their @oauth_2 client secret in JavaScript 🤦‍♂️

Oregon City, Oregon, USA

#oauth

Thu, Aug 1, 2019 10:36am -07:00

10 likes 4 replies
Have you written a response to this? Let me know the URL:
- 🌮 Dave Millar 🌮 puz.fun/@dave
  
  @aaronpk did they also use a DHTML script to block right-clicking so nobody can view the source of the page?
  
  Thu, Aug 1, 2019 5:38pm +00:00
- Not Fake Adam Kalsey twitter.com/akalsey
  
  But they base64 encoded it, so that’s OK, right?
  
  Thu, Aug 1, 2019 5:55pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  not even 😭 the variable is called "client_secret"
  
  and worse, it's a bank
  
  Thu, Aug 1, 2019 5:56pm +00:00 (via brid-gy.appspot.com)
- Not Fake Adam Kalsey twitter.com/akalsey
  
  I once had to respond to a security audit that included a code scan. The scanner red flagged any variable called password or secret, or various misspellings thereof.
  
  You could store the password, you just had to name the field “donottellanyone” or something.
  
  Thu, Aug 1, 2019 5:58pm +00:00 (via brid-gy.appspot.com)

Posted in /notes using quill.p3k.io