Hacker News Reader

Comment by t1234s | Hacker News Reader

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

View on HN

It's weird, is there no feedback of any kind in these companies?

All outsourced maybe?

I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.

Even if it was outsourced is there zero quality control?

Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes!

The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"!

Having to rearc after these terrible designs would cost more, so you can see where this is going...

Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.

>$('#securityQuestionModal').modal('show');

Iv seen a couple of industrial deployments "secured" by a modal so Im totally buying whats in the article.

I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review.

He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page.

One of the first XHR rows was to an endpoint named “getKeys”

The return object was the root keys for the AWS prod account.

This crap is incredibly common. Maybe not that egregious, but close enough.

Reply on news.ycombinator.com