Hacker News Reader

Hacker News

Comment by rikkus | Hacker News Reader

Parent Full thread

rikkus

Went to sign up for a 'developer account'.

My password: udxeik8SovTCW0qhlPMr00dBBWTW6zeAbDQ77PLIOcidhXZsEhg7yP10B4ygqkzU

Rejected with: - Password must contain at least 1 special character - Password must not be longer than 15 character(s)

So... ?Gc76+;%ap``h}( - Invalid Character(s) in Password

Less 'special'? ... %_H$Jo#];:=?RK& - Password must contain at least 1 numeric character

Here you go then: 8-8jvr£B9#UQ4Q/ - Invalid Character(s) in Password

Gah. I know just know if I sign up for this, in a few months there'll be an announcement about how they've had their account details 'stolen' by 'hackers'. Not that they're incompetent or anything.

View on HN

So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'.

Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link.

http://appcenter.html5tools-software.intel.com/csd/ForgotPas...

That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token...

EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI

So does this mean I could reset anyone's password, given their email address?

Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'.

Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic]

Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were.

Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.

I just did. For your convenience, your new password is IDisposable#1.

Thanks for that. From now on, I'm keeping my passwords in plain text on public websites and having other people set them for me.

This was the best discussion I've read on hackernews in a long time. So I made a screen shot and put it on my blog :) http://fluffyelephant.com/

I got a different token when I tried it.

pa1Wndjk+Ly3KAYrvpJghEFQUE1PQkk=

It looks like it always ends in APPMOBI, but the first part can be different.

Thanks for pointing this out. We have changed token schema and validation process.

Reply on news.ycombinator.com