Hacker News Reader

Comment by minikomi | Hacker News Reader

There was a bug (maybe still is) in airbnb where setting your name to include a certain character would brick your login to the web app because it broke header parsing. Reported it but was deemed 'non critical'..

Edit, just looked up the mail

- It was an 'equals' sign

- the reply was:

" It sounds like you cannot cause someone else's account to be in this state, only your own account. Is this correct? How would you get someone else to change their account name so that it includes an equals sign?

It appears that there's no way to cause another user's account to get into this state, and in this case, I do not see a security implication here. "

View on HN

That does indeed sound non-critical, how many names do you run into with equal signs in them?

Little Bobby Tables’ cousin, Jenny =true

The name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.

This is a key issue I see with bugbounty programs.

They tend to react with "either you can show us that this is a real danger or we'll ignore it".

It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.

> They tend to react with "either you can show us that this is a real danger or we'll ignore it".

This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1]

[0] https://www.microsoft.com/en-us/msrc/bounty-online-services?...

[1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

I fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.

Interestingly, Wikipedia does give at least one example:

https://en.wikipedia.org/wiki/Equals_sign#Personal_names

I started a small company with a colon “:” in it. Should have not done that...

I regularly encounter services that does not handle it very well

When foreign names are written in Japanese there are a couple of ways of handling puncutation, and sometimes an equals sign is used. I hadn't actually thought about why it was used, but it seems an interpunct (・) is used where a space would be and equals can be used for an internal hyphen, or for words that are separated by a space but part of the same unit (de Niro).

Some more detail on this, with citations, from an ask-a-librarian board (in Japanese).

https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index....

You only need to run into one to make someone's life a PITA. Treat names as free strings, because there are a lot of names that do not conform to any notion of western normality.

> how many names do you run into with equal signs in them?

That's not the issue ... I have not personally tried this or examined it, it looks like you can change the state of the header parser by including interesting characters in your name. I am not sure if this is server-side or client-side. If the problem is server side, there is a chance you could tweak the strings to get interesting results. But trying to prove that this is a serious problem without explicit authorization will likely have adverse consequences for anyone who does, so only people who are already doing shady stuff explore it.

Whenever someone mistypes their hyphenated name with an =, say on their phone.

https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

Not every little bug that requires technical knowledge is worth a monetary reward.

I haven't seen anyone claim otherwise.

Well the wording of their response email implies he reported it to a bug bounty program

Did you submit it as a bug or a security issue? There are indeed no security risk here, but usability wise, your account being bricked is a pretty serious issue.

Just to their bug bounty program. Thought it would be kind of annoying for someone whose livelyhood depends on the side to be locked out.

My guess is that bug bounty programs refers only to security issues (even if the name suggests otherwise), and unfortunately the team triaging it is probably only focused on handling security teams. Actually sometimes triaging is handled by a different company entirely. In general, very few companies have a solid way to reporting normal everyday non-security bugs, even if they are usage breaking.

Reply on news.ycombinator.com