Hacker News Reader

Comment by knodi123 | Hacker News Reader

> Does this sound insane to you? Obviously it should,

I dealt with the exact same thing in my 2nd ever job. Entire customer and product database (with plaintext passwords) stored in a multi-meg public-facing .js flat file that had to finish loading before the app could do anything (with early-2000s internet). And to top it off, the app was a single monolithic file, in a directory with names like index.1.js, index.final.js, index.newest.js, index.45.js, etc etc.

I had enough experience with best practices to go to our CEO and get the CTO fired, and went about rewriting it with git, mysql, and server-side logic with an actual architecture. And then, the windows server it was all running on got pwned into a porn server, and somehow it was my responsibility despite me never having seen this server and not even having admin permissions.

Man, my first few jobs were educational!

View on HN

I heard rumor back in the late `90's of an e-commerce site that stored the prices for it's products in the browser cookie. Presumably a motivated buyer could go in and edit the cookie before checkout, although I don't know if that ever actually happened.

The one I’m thinking of stored prices in the HTML form as a hidden field. It trusted the client-submitted value when deciding how much to charge you.

The justification I heard for the ethics of enjoying the home-rolled discount was that it was similar to haggling. The store chose to accept the offer.

Not sure I totally accepted that, but appreciated the creative thinking.

Low hanging fruit that seemed somewhat common back in the day was not verifying prices of items on the backend. So a somewhat technical user could edit the price in the html field of the item to be $10 instead of $100.

Between this and everything being non https - what a time to be alive.

IIRC, an early version of myspace actually used a GET form for login. It immediately redirected, but if your browser was wide enough, and your eye was trained on the address bar and knew what to look for, you'd see the password flash by in plaintext.

why is that an issue? just in case someone is peering over your shoulder? the pw will be sent in the request body as plaintext on a post...

> just in case someone is peering over your shoulder

Yes, exactly that. That's why I highlighted the risk of someone looking in the right spot at the right time.

> the pw will be sent in the request body as plaintext on a post

Which is how every single login form in the world works, today, for this very reason.

This brings back memory: This was the case for a gold-buying website for the Runescape game in the 2000s. You could edit your cookies or other front-end facing information to change the price of items in your cart, so you could buy gold or items for much cheaper than the market rate. At some point, while the vulnerability remained, they started cancelling orders abusing this and manually checking the orders.

I think you could still find some old youtube videos or threads on obscure forums with enough digging about that topic, that's how I learned of it initially.

So this was a real thing!

Back in these days I've seen one learning system that stored the correct answer in the value attribute of the radio button input tag.

Reply on news.ycombinator.com