I Just Logged In As You

Jeff Atwood

03 May 2009 — 2 min read — Comments

I received this anonymous email a few days ago:

I found what one could call a security hole in Stackoverflow. I’m curious enough to go digging around for holes, but too ethical to actually do anything with them. However, I’m afraid that by pointing it out I’ll get banned, because a good member doesn’t poke around like I just did. I promise I did nothing with what I found out besides confirm the hole.

You may be wondering why I’m e-mailing you personally, rather than [email protected]. It’ll make sense when I reveal the hole, which is...

I logged in as you.

How? Well, there were two pieces of the puzzle, the password and the openid provider. I had a possible password; today your blog post revealed the openid provider. I logged in, freaked out that it actually worked, then logged out. The only reason I had the password is because your password is totally inadequate for someone running a site like StackOverflow. I don’t want to go into any more detail than that, but man - dictionary password!

I’ve read about the secret “hacker” badge... if you’re not going to punish me for my transgression, then I will reveal who I am and I sure wouldn’t mind getting it. Still, I can understand if you’re upset - I wouldn’t want someone else digging up my password. (That’s why I send this friendly e-mail instead of hoarding, or worst, selling, the information.)

Please, go change your openid password, before someone less ethical than I finds it.

- A friend of the site

These are the kinds of emails that make your blood run cold. Good thing I haven’t made too many enemies. Today, I mean. So far. The day’s not over, yet.

Is it true? Did someone just log in as me? I checked the OpenID logs, and sure enough, there was a valid login from an IP address I didn’t recognize. He wasn’t bluffing. He really did log in as me.

While it’s true I probably should have used a more secure password, in my defense:

The particular OpenID account I use is typically for low-value logins like blog comments and so forth. It’s not exactly a high security form of identity for the use I have in mind.*
The password was relatively simple, but I wouldn’t go so far as to characterize it as a “dictionary password” – it wasn’t quite “password1” or “monkey” or “happiness,” or anything like that. It was weak, yes, but dictionary password attacks, like all brute force attacks, are still for dummies.

What’s interesting about this, though, is how it happened. I’ll reveal that tomorrow, with this one hint: I’ve talked about this exact sort of vulnerability several times on this very blog.

Until then, take your best guess: how do you think this person discovered my password? I’ll highlight the best response tomorrow with the answer.

*Although as a Stack Overflow moderator I have unusual powers and probably should have used an alternate OpenID with more security.

Welcome to The Internet of Compromised Things

This post is a bit of a public service announcement, so I’ll get right to the point: Every time you use WiFi, ask yourself: could I be connecting to the Internet through a compromised router with malware? It’s becoming more and more common to see malware installed not

Computer Crime, Then and Now

I’ve already documented my brief, youthful dalliance with the illegal side of computing as it existed in the late 1980s. But was it crime? Was I truly a criminal? I don’t think so. To be perfectly blunt, I wasn’t talented enough to be any kind of threat.

I Was a Teenage Hacker

Twenty-four years ago today, I had a very bad day. On August 8, 1988, I was a senior in high school. I was working my after school and weekend job at Safeway as a cashier, when the store manager suddenly walked over and said I better stop ringing up customers

Make Your Email Hacker Proof

It’s only a matter of time until your email gets hacked. Don’t believe me? Just read this harrowing cautionary tale. When [my wife] came back to her desk, half an hour later, she couldn’t log into Gmail at all. By that time, I was up and looking