{"id":274,"date":"2012-07-11T16:20:23","date_gmt":"2012-07-11T15:20:23","guid":{"rendered":"http:\/\/pgregg.com\/blog\/?p=274"},"modified":"2019-10-16T23:51:18","modified_gmt":"2019-10-16T22:51:18","slug":"menshn-another-password-design-flaw","status":"publish","type":"post","link":"https:\/\/blog.pgregg.com\/blog\/2012\/07\/menshn-another-password-design-flaw\/","title":{"rendered":"Menshn: Another password design flaw"},"content":{"rendered":"<p>Ok &#8211; so I forgot my password on Menshn, again, and went to reset my password. Normal email address+token thing &#8211; except I noticed another problem.<\/p>\n<p>Menshn emails you a link in the form:<\/p>\n<pre style=\"padding-left: 30px;\">pwreset.php?e=email@address.com&amp;c=8chartoken<\/pre>\n<p>At least they are not emailing plain text passwords again. But, I noticed that the token link can be used both multiple times, and it does not expire.<\/p>\n<p>Requesting a new token to be emailed to you invalidates earlier tokens &#8211; however it remains the case that the most recent pwreset token stays valid.<\/p>\n<p>Ooops. Bad Menshn, bad. Back to the naughty corner for you.<\/p>\n<p>At least clear the stored token when the user uses it once (and ensure you don&#8217;t accept blank tokens).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ok &#8211; so I forgot my password on Menshn, again, and went to reset my password. Normal email address+token thing &#8211; except I noticed another problem. Menshn emails you a link in the form: pwreset.php?e=email@address.com&amp;c=8chartoken At least they are not emailing plain text passwords again. But, I noticed that the token link can be used &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/blog.pgregg.com\/blog\/2012\/07\/menshn-another-password-design-flaw\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Menshn: Another password design flaw&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4,12],"tags":[61,65,78,90],"class_list":["post-274","post","type-post","status-publish","format-standard","hentry","category-general","category-systems","tag-luke-bozier","tag-menshn","tag-passwords","tag-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQOUu-4q","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/posts\/274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/comments?post=274"}],"version-history":[{"count":1,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/posts\/274\/revisions"}],"predecessor-version":[{"id":606,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/posts\/274\/revisions\/606"}],"wp:attachment":[{"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/media?parent=274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/categories?post=274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pgregg.com\/blog\/wp-json\/wp\/v2\/tags?post=274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}