jeffalo — 5/6/2023, 1:57:51 PM

i had a zoom call with people to discuss a major vulnerability i found.

♥ 16 ↩ 0 💬 25 comments

comments

joebiden:

depression?

5/9/2023, 4:31:46 PM
nihalnavath:

Cool, for which website/app?

5/9/2023, 11:02:56 AM
owl:

ooh i think i might know what it is

5/7/2023, 2:19:24 PM
jeffalo:

really?

5/7/2023, 7:10:48 PM
owl:

i think we’re talking about different things, its when i logged into poprock’s account with a password, even though he had no password assigned.

5/13/2023, 3:26:13 AM
jeffalo:

uh thats bad.

5/13/2023, 11:33:58 AM
owl:

i cant do it anymore if i try doing it with @owlsss-owlclient

5/14/2023, 2:26:21 PM
owl:

i think you already fixed it

5/14/2023, 2:26:31 PM
jeffalo:

this sounds like a bug with your client rather than the server — as far as i can tell, i haven’t touched auth code in years

5/15/2023, 6:22:46 AM
owl:

huh, maybe, idk

5/18/2023, 12:15:23 PM
owl:

all i know is apparently i logged into an account with a password even though the account had no password assigned, and then you gave me a warning

5/18/2023, 12:16:29 PM
jeffalo:

that sounds more like the user configured their account wrong. right now its possible for someone to set their password to be blank (which is different from disabling password login).

5/18/2023, 1:43:21 PM
grahamsh:

i highly doubt you do lmao

5/8/2023, 10:44:16 AM
paradocktheman:

you know jeffalo is serious when he starts using periods in his posts and replies

5/7/2023, 12:33:31 AM
jeffalo:

wait till you see one with capital letters.

5/7/2023, 7:17:36 AM
paradocktheman:

oh

5/7/2023, 4:19:49 PM
wynd:

haha imagine, that would be scary

5/8/2023, 6:44:46 PM
mybearworld:

:)

6/27/2023, 1:34:02 PM
oren:

You should start documenting your bug bounties. A lot of people do

5/6/2023, 2:23:05 PM
radi8:

he might not be able to, because they aren't fixed yet

5/6/2023, 4:01:45 PM
oren:

He's found other ones before

5/6/2023, 4:13:43 PM
radi8:

yeah, I know

5/6/2023, 4:14:07 PM
jeffalo:

all my reported bug are documented. i just don’t have permission to publish.

5/6/2023, 5:18:36 PM
oren:

Oh

5/6/2023, 5:50:17 PM
nihalnavath:

I agree with this, please do, will be an interesting read.

5/9/2023, 11:05:33 AM