Hacker News Reader

Comment by latch | Hacker News Reader

Wherever the truth lies, which in my mind is much closer to Frind's side, an SQL injection attack, in 2011, on an actively developed site, using modern day technology, is pathetic.

I've tried to come up with analogies that explain how people can write systems without actually knowing how to program. Something like, just because I know how to make nachos or pancakes doesn't mean I'm a cook. This is the type of stuff I'm talking about though. You can know about if statements, variables and even fancy classes...you can put it all together and build a system and be hugely popular, but it doesn't mean you are any good at programming.

Duct tape programmers indeed.

View on HN

"an SQL injection attack, in 2011, on an actively developed site, using modern day technology, is pathetic"

You left out -- stores passwords in plain text.

Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know.

At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. No polish, a bizarre ui, and just general weirdness. This is the kind of shodiness I'd expect.

You can encrypt a password in the database and still keep it retrievable (for things like this). Storing it in plain text, however, is inexcusable.

Storing passwords using reversible encryption is not much better than plaintext.

Not much better is still better.

And it can be significantly better. In a past situation I stored sensitive information using public/private keys. Even if you got complete access to the webservers and database, you still could not decrypt that information. It would only be useful if you had access to the private key, which was much more securely controlled.

Iirc okcupid would let you login with one click via email via a token. I'm fairly sure they stopped doing this a while ago. A much better solution, with a better experience as well.

Neither way is ideal, but making it easier to login probably helps viral growth.

At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers.

Developer, not developers.

It started as a part time side project, and until 2007 Marcus Frind was the sole employee.

2007 is over three years ago.

Running a site as large as plenty of fish solo likely doesn't leave one with a ton of time for new development, unless he completely ignores customer service emails.

The grandparent is saying that POF should be considered to have been written by one developer, because that's what it was until 2007.

No they don't have to. They can email users a link with an embedded hash that automatically logs them in. These links can expire. This is similar to how an email password reset works.

But the user could've still forgotten it though..

The system quellhorst describes does not require the user to know the password, or even their own username. They click the link in the email and they are automatically logged in; it's an alternate authentication scheme. If they have lost their password that's a separate issue that should be handled separately but similarly by emailing them a link, again with an 'embedded hash', that allows them to reset their password.

The assumption of course is that they and only they can access the email address specified in their account profile. If that's not the case then this all becomes a bit more problematic.

Yeah, I agree it's unbelievable stupid. that was meant as a tongue in cheek statement, hence the 'yeah, I know' at the end.

OKCupid used to use tokens fwiw.

Hey, now ... I bet a lot of banks do it, so it must be okay. :-/

Between that, and mandating short passwords, which a LOT of banks do. :-(

Calling author(s?) of POF `duct tape programmer(s)' does harm to jwz (http://www.joelonsoftware.com/items/2009/09/23.html)

They (people who don't actully know how to program) can build a large system on a shoestring budget exactly because they don't know how to build it properly, or how hard it is to. No distractions over those pesky little matters like ACID properties, security, accessibility, etc. etc..

Because those are a major part of what slows programs developed by professional developers.

No distractions, no slowdown, until a security consultant mails you a proposition you can't easily refuse. The hackers Mr Chris Russo alleges were exploiting the hole did it quietly (if at all), for obvious reasons. Nobody knew, nobody cared until now. Several years of good business, right? And free publicity now, isn't it?

To call these people Duct tape programmers because of one SQL injection weakness is somewhat unfair. Writing code isn't hard. Writing code that works is harder. Writing code that's bug free is very hard. Writing code that is not only functionally bug free but non-functionally bug free (including security as a non-functional requirement) is ridiculously and ludicrously hard.

It's only because some frameworks do 90% of the heavy lifting (and parameterised queries for the 5 extra percent that's not covered) that we don't see SQL injection as much as we used to.

This week it was PoF. Previously it's been Twitter, Facebook, even HN. Are the people behind these Duct tape programmers?

I'm going to touch on how hard security can be in my talk at http://www.meetup.com/HNLondon/ - if there are any London-based HN readers that are going, I look forward to seeing you all there.

There are lots of programmers out there who do a fine job, they are just clueless about security.

For companies that have programmers that work great, but aren't security experts, it's time to hire security experts.

Suggesting that all the work the programmers did is worthless because they aren't security experts is seeing the world as black and white. It's gray my friend.

> There are lots of programmers out there who do a fine job, they are just clueless about security.

Yeah, there are lots of mechanics out there who do a fine job. They are just clueless about breaks ;)

Stupid analogy aside: If you as a programmer who develops stuff for production are not aware of rules like "NEVER EVER FUCKING TRUST ANY USER INPUT" then you're just wrong for the job.

I don't agree because I work in the industry.

Some are programmers who manage the User Database. They deal with all user accounts data. But they aren't the same guys who are responsible for server security.

I'm talking Enterprise Apps that support tens of thousands of users.

This guy was responsible for everything, being the sole developer.

There are also lots of programmers who are clueful about security, but work for clueless managers or organizations. I've had many a conversation that went like this:

"Okay I put together this prototype and it's working. I should check it over for SQL injection spots and---"

"StoptalkingnotimeforthatSHIPITNOW!"

I find it interesting that my original comment started at -3 and is now +7..and that the "so blame the victim" went to +3 and is now at -1. Not sure why I find it interesting, but dang it'd be nice to see who up/down votes.

The problem now is that with all this noise, POF is certainly going to be hacked. Others will want to follow Chris path.

POF founder habilities are going to be tested in the media arena and in the technical arena at the same time. Also lets see how he manages the customers & the legal side. Hard!

So... blame the victim? Really?

Why not, when they are being completely irresponsible with millions of people's data?

Nothing like hearing reports of security issues to make one remember the adage "There but for the grace of God go I." Humility may be in order: substantially none of us are capable of delivering a system without at least one game-over bug in it.

There but for the grace of contracting security professionals go I.

Incidentally, their notification emails routinely contain your password in cleartext as a "reminder". I signed up for an account several years ago but was put off by the incredibly ugly design. Here's an excerpt from an old email from them (note, redacted by me!) This one is from a few months ago:

-- Hello REDACTED,

Thank you for signing up on 10/12/REDACTED 4:08:52 PM. Remember your password is REDACTED. --

The most recent one from had an empty string as my password, as in "Remember your password is ."

That is standard behavior for many web sites whose purpose includes no important personal information. vBulletin and some other forum engines do that by default. These site owners figure, probably rightfully so, that the support burden for a forgotten password exceeds the expected value of some black hat actually intercepting the plaintext email (low) times the meaningful impact of any ensuing activity (also low). The chief risk is in compromising a password that this user also uses for applications of high security impact, but it is not the responsibility of this particular site owner to protect a user from generally dumb behavior.

More generally: security best practice is not always about enforcing as tightly as you possibly can. Security has real costs and it's a cost-benefit tradeoff against many other factors.

That may be their assumption (clearly is, given the evidence), but I think it's a pretty poor one and it's certainly off-putting as a potential user.

A dating site contains, practically by definition, a fair bit of personal information. It's not online banking, but there's a lot of ugly stuff that an attacker could do if they could break into a large number of user accounts, and particularly if they could de-anonymize those accounts.

POF was pretty clearly sacrificing security -- which in this context means the potential privacy of their users -- in order to get more engagement and build userbase. Bluntly: they were taking risks with their users' data in order to build their business.

That's not terribly cool in my book, even though I can see why they might have made the decision. The fact that it's understandable doesn't mean that it's right.

They do have personal information, your password for that site and your email address. Lots of people reuse passwords, and that might be their email password. Once you have email & password, you have access to 90% of their online identities.

vBulletin does not store passwords in the clear.

Nor does it transmit passwords in the clear when you go to recover an account.

Same thing with IP.Board (Invision).

The only one that I know of that has done so is phpBB, and I am not sure if it has been fixed or not because with their security track record I don't even want to try them.

The "victim" framing here isn't helping anyone. This is a silly thing to argue about.

The victims are the users who mostly lack the technical fortitude to realize the perils of using a single user identifier/password combination across many different sites. The amount of identity theft that could occur by dint of PlentyOfFish's absolute carelessness renders them just as complicit in wrongdoing as the attackers who shed light on the problem. To call POF a 'victim' is absolutely wrong.

They're not the victim - they're guiltier than anyone who grabs their customer data.

When you provide an online service that gathers consumer information - particularly sensitive consumer information (such as that which you might find on, say, a dating site), it's your responsibility to secure it. If you get hacked, it's your fuck-up, your responsibility, your culpability.

And no, that's not my opinion, it's objective fact - read, for instance, about PCI DSS, and the associated very steep penalties for information leakage.

Reply on news.ycombinator.com