While cleaning out old email I found this email from Legionnare where he describes a service called webtickle that simply asks for way too much information. Frankly this kind of thing makes me very uncomfortable, but decide for yourself. Here’s his email:

Hey,

check this website out, http://web.tickle.com/. I haven’t really explored it but it seems to have a large collection of tests determined to figure out things about you or your friends.

I’m sending you this because when it comes to forwarding a test to your friends, the site asks for your hotmail/yahoo username and password in order to access your address book (omg). What is worse is that entire session in not encrypted.

OK, maybe this isn’t major-company.com but I’m guessing this is a popular site and a perfect trap for naive people who haven’t heard the words security, encryption and plaintext and are very likely to get an unpleasant surprise in the near future.

This is really a quick e-mail. To read more about this, check my blog entry at http://advancingsf.blogspot.com/2006/09/gimme-address-keys-to-your-house.html.

This is exactly the sort of thing that causes cascading security issues. Let’s take a hyptothetical situation where web.tickle.com had some sort of cross site scripting vulnerability in them. Next, let’s say someone were to use that same vulnerability to phish for the same information that web.tickle.com does. Next let’s say they get your username and password to hotmail and yahoo. Next let’s say you keep old email in there from your various accounts that require valid email addresses for authentication. Next let’s say the user goes to those websites and clicks the forgot password feature. Next the user takes the unique string and logs in as you. Next they change the email address on file and and confirm and delete and remnants to your old account and the email and password reset. Finally the user has permanant and final access to your account.

The problem here is the concept of a “half” factor authentication. Dual factor authentication is “something you have and something you know”. That is, a hardware device that is something you have, and the thing you know which is your password and when used in combination they give you access to something. In this case the thing you “have” isn’t really anything you have or anything you control. And because the relative state of password security is low (that is people don’t really secure their email address or their password that they also happen to use everywhere else) it is extremely easy to use them in combination to gain access to other (unrelated sites).

How do you tell a user that “You must protect your password on company-a’s website so that you don’t get hacked on company-b’s website through your email?” No one will understand that. Despite it being good for their business model, I think asking this sort of information is tantamount to phishing. No one should ever ask for your username or password other than the site that needs it for authentication purposes. The more people think this sort of thing is okay the more it will be used against them.

This entry was posted on Friday, September 22nd, 2006 at 1:44 pm and is filed under Webappsec. You can leave a response as well.