Hacker News Reader

Comment by renewiltord | Hacker News Reader

This is a non-problem. There is no real threat model. It's like how you can cast to my TV if you're in my house. Sure, anyone could attack the party by posting porn on the TV but that's really not going to happen because I'm not going to invite you and put you in the wifi if you're the kind of person who does that.

View on HN

Here's a threat model. My university used to give students /~s123456 folders. On the same domain as the main student platform, and as the main university site. I'm not sure if they still do this but it was less than 3 years ago. Considering the age of the infrastructure, there's even a good chance that session cookies were not marked HttpOnly. Even if they weren't, I can put a login form on my page, and even if the user doesn't get tricked into using it through phishing, if their browser autocompletes it I now have their username and password.

Now yes, our uni probably shouldn't be giving out userdirs to all students, much like wifi, you should only let in the people you trust. But that's exactly the point of the article.

Exactly correct. Even in the early 90s best practice was to house your user webspaces at users.isp.net/~user. Even now the most exciting thing you could do with this is use JavaScript to submit a contact form from another users webspace.

This is like complaining that Geocities users shared a security domain. Surprise, there was nothing of value hosted there to start with.

You obviously never saw my Pokemon fansite from 1998

It would have been much easier to say that if weaponised, an XSS vulnerability can access resources across the entire domain as if they were the victim, and should effectively be considered an account hijack of any exploited victims.

It really has nothing to do with homepaths, or even user-supplied data whatsoever.

People do turn malicious. One of the biggest sources of attacks in computer security is current and former users.

After all, if we didn't need to care about user level security, why don't we let everyone be root? Surely we only created accounts for people we can trust, right?

I'm not saying that your point isn't valid that the exposure here isn't very small. I'm just saying that your logic isn't really very sound.

Ah, a sensible take on security. Refreshing.

Technically speaking, there could be a security vulnerability on a dynamic site that is being hosted with mod_userdir, even though the owner of it is "trusted". With that model, if the security vulnerability is exploited by a third party to attack a different mod_userdir user, then it's not really about who you trust to invite, since the entire Internet is technically invited.

Also, example.com/~username style URLs usually are 1990s-style static web sites where the only Javascript is something like a marquee. They are not the kinds of sites which have extensive Javascript or a web forum people can sign in to; at most a site like that would have a guestbook.

Are you kidding? It's a standard feature of Apache, used by universities all over the place. Many shared hosting providers offered the feature for customers that weren't ready to update their DNS to the new host, until quite recently.

Marquees were HTML

MSIE-only extension.

Edit: The "true" marquee was running in the now defunced status bar (window.status) via JS.

::Vietnam flashback music::

Reply on news.ycombinator.com