Hacker News Reader

Comment by nijave | Hacker News Reader

I saw in a thread somewhere else a while ago a bit more detailed explanation:

The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side

The reporter had to view source and base64 decode the data

Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"

View on HN

> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom.

Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1].

[1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...

Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.

To be fair, leaving a SQL injection hole makes it pretty dynamic.

Wow. That's the real 10x developer play. New api? Why, we have that one endpoint!

That’s basically what Postgraphql is.

Blame your own process, that guy was doing the right thing to get interviews.

Woah. I did not realize that either.

It would be trivial to loose a bot on government TLD's and see who else is putting unencrypted PII in their viewstate.

> If those identifiers contain sensitive data, such as customer IDs, you should encrypt the view state data in addition to or instead of sending the page over SSL.

It would be hilarious if those docs got updated to say customer IDs or SSNs. Lol.

The craziest part is that if you had made that same mistake and leaked a bunch of SSNs the same government would be fining you and accusing you of being negligent. It's insane.

I can't believe the defense wouldn't be able to present an expert witness / cross-examine the prosecution's on the distinctions between "encoding" and "encrypting."

If Wikipedia tells you how to read something, it is not encrypted.

If base64 is an encryption, then so is jpeg or *.docx .

I guess base64 is cryptographically a substitution cipher with a public pad. Which... you'd think using a ~2000+ year old method in a known-harmful way would stretch the term.

Reply on news.ycombinator.com