8 ms·

Returning the OTP in the request API response is wild. Like why?

matja 1y ago
Eliminate your database costs with this one easy trick!
mooreds 1y ago
I too am bewildered. Maybe to make it easier to build the form accepting the OTP? Oversight? I can't think of any other reasons.
- Vuska 1y ago
  Oversight. Frameworks tend to make it easy to make an API endpoint by casting your model to JSON or something, but it's easy to forget you need to make specific fields hidden.
- ksala_ 1y ago
  My best guess would be some form of testing before they added sending the "sending a message" part to the API. Build the OTP logic, the scaffolding... and add a way to make sure it returns what you expect. But yes absolutely wild.
- Alex-Programs 1y ago
  I assume that whoever wrote it just has absolutely no mental model of security, has never been on the attacking side or realised that clients can't be trusted, and only implemented the OTP authentication because they were "going through the motions" that they'd seen other people implement.
  - ceejayoz 1y ago
    https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult
  - pixl97 1y ago
    Everyone that programs should take blackhat classes of some kind. I talk to so many programmers that really don't understand what hackers/attackers can actually do.
hectormalot 1y ago
One reason I could think of is that they may return the database (or cache, or something else) response after generating and storing the OTP. Quick POCs/MVPs often use their storage models for API responses to save time, and then it is an easy oversight...
- oulu2006 1y ago
  that's my first thought at as well - like a basic CRUD operation that returns the row that was created as a response.
ceejayoz 1y ago
Save a HTTP request, and faster UX! What's not to love? When Pinterest's new API was released, they were spewing out everything about a user to any app using their OAuth integration, including their 2FA secrets. We reported and got a bounty, but this sort of shit winds up in big companies' APIs, who really should know better.
MBCook 1y ago
So the UI can check if what they enter is correct. It’s very sensible and an obvious solution if you don’t think about the security of it. A dating app is one of the most dangerous kinds of app to make due to all the necessary PII. this is horrible.
- ryanisnan 1y ago
  > if you don’t think about the security of it. This is big brain energy. Why bother needing to make yet another round trip request when you can just defer that nonsense to the client!
  - joelhaasnoot 1y ago
    No one would ever hack my app!
- pydry 1y ago
  Smacks of vibe coding
  - bitbasher 1y ago
    I don't think a language model is that stupid. This smacks of pure human stupidity and/or offshoring.
    - orphea 1y ago
      But LLMs are that stupid. Do you remember that guy who vibe coded a cheating tool for interviews and who literally leaked all his api keys/secrets to GitHub because neither him nor a LLM didn't know better?
      - bitbasher 1y ago
        Fair enough. Since it's trained on human stupidity, I suppose it would reflect that stupidity as well.
      - 1y ago
gwbas1c 1y ago
It appears that the OTP is sent from "the response from triggering the one-time password". I suspect it's a framework thing; they're probably directly serializing an object that's put in the database (ORM or other storage system) to what's returned via HTTP.

Eliminate your database costs with this one easy trick!

I too am bewildered. Maybe to make it easier to build the form accepting the OTP? Oversight? I can't think of any other reasons.

Vuska 1y ago
Oversight. Frameworks tend to make it easy to make an API endpoint by casting your model to JSON or something, but it's easy to forget you need to make specific fields hidden.
ksala_ 1y ago
My best guess would be some form of testing before they added sending the "sending a message" part to the API. Build the OTP logic, the scaffolding... and add a way to make sure it returns what you expect. But yes absolutely wild.
Alex-Programs 1y ago
I assume that whoever wrote it just has absolutely no mental model of security, has never been on the attacking side or realised that clients can't be trusted, and only implemented the OTP authentication because they were "going through the motions" that they'd seen other people implement.
- ceejayoz 1y ago
  https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult
- pixl97 1y ago
  Everyone that programs should take blackhat classes of some kind. I talk to so many programmers that really don't understand what hackers/attackers can actually do.

hectormalot 1y ago

One reason I could think of is that they may return the database (or cache, or something else) response after generating and storing the OTP. Quick POCs/MVPs often use their storage models for API responses to save time, and then it is an easy oversight...

oulu2006 1y ago
that's my first thought at as well - like a basic CRUD operation that returns the row that was created as a response.

ceejayoz 1y ago

Save a HTTP request, and faster UX! What's not to love? When Pinterest's new API was released, they were spewing out everything about a user to any app using their OAuth integration, including their 2FA secrets. We reported and got a bounty, but this sort of shit winds up in big companies' APIs, who really should know better.

MBCook 1y ago

So the UI can check if what they enter is correct. It’s very sensible and an obvious solution if you don’t think about the security of it. A dating app is one of the most dangerous kinds of app to make due to all the necessary PII. this is horrible.

ryanisnan 1y ago
> if you don’t think about the security of it. This is big brain energy. Why bother needing to make yet another round trip request when you can just defer that nonsense to the client!
- joelhaasnoot 1y ago
  No one would ever hack my app!
pydry 1y ago
Smacks of vibe coding
- bitbasher 1y ago
  I don't think a language model is that stupid. This smacks of pure human stupidity and/or offshoring.
  - orphea 1y ago
    But LLMs are that stupid. Do you remember that guy who vibe coded a cheating tool for interviews and who literally leaked all his api keys/secrets to GitHub because neither him nor a LLM didn't know better?
    - bitbasher 1y ago
      Fair enough. Since it's trained on human stupidity, I suppose it would reflect that stupidity as well.
    - 1y ago

gwbas1c 1y ago

It appears that the OTP is sent from "the response from triggering the one-time password". I suspect it's a framework thing; they're probably directly serializing an object that's put in the database (ORM or other storage system) to what's returned via HTTP.