{"action":"created","issue":{"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/788","repository_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry","labels_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/788/labels{/name}","comments_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/788/comments","events_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/788/events","html_url":"https://github.com/geoffhumphrey/brewcompetitiononlineentry/issues/788","id":243516223,"number":788,"title":"Forgot/reset password process in 2.1.10 remains insecure and increasing the number of security questions isn't good enough","user":{"login":"gene1wood","id":1134034,"avatar_url":"https://avatars0.githubusercontent.com/u/1134034?v=4","gravatar_id":"","url":"https://api.github.com/users/gene1wood","html_url":"https://github.com/gene1wood","followers_url":"https://api.github.com/users/gene1wood/followers","following_url":"https://api.github.com/users/gene1wood/following{/other_user}","gists_url":"https://api.github.com/users/gene1wood/gists{/gist_id}","starred_url":"https://api.github.com/users/gene1wood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gene1wood/subscriptions","organizations_url":"https://api.github.com/users/gene1wood/orgs","repos_url":"https://api.github.com/users/gene1wood/repos","events_url":"https://api.github.com/users/gene1wood/events{/privacy}","received_events_url":"https://api.github.com/users/gene1wood/received_events","type":"User","site_admin":false},"labels":[{"id":331350307,"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/labels/confirmed","name":"confirmed","color":"bfd4f2","default":false},{"id":322819363,"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/labels/in%20latest%20master%20commit","name":"in latest master commit","color":"fbca04","default":false},{"id":530234493,"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/labels/v2.1.10","name":"v2.1.10","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":{"login":"geoffhumphrey","id":5216502,"avatar_url":"https://avatars3.githubusercontent.com/u/5216502?v=4","gravatar_id":"","url":"https://api.github.com/users/geoffhumphrey","html_url":"https://github.com/geoffhumphrey","followers_url":"https://api.github.com/users/geoffhumphrey/followers","following_url":"https://api.github.com/users/geoffhumphrey/following{/other_user}","gists_url":"https://api.github.com/users/geoffhumphrey/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffhumphrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffhumphrey/subscriptions","organizations_url":"https://api.github.com/users/geoffhumphrey/orgs","repos_url":"https://api.github.com/users/geoffhumphrey/repos","events_url":"https://api.github.com/users/geoffhumphrey/events{/privacy}","received_events_url":"https://api.github.com/users/geoffhumphrey/received_events","type":"User","site_admin":false},"assignees":[{"login":"geoffhumphrey","id":5216502,"avatar_url":"https://avatars3.githubusercontent.com/u/5216502?v=4","gravatar_id":"","url":"https://api.github.com/users/geoffhumphrey","html_url":"https://github.com/geoffhumphrey","followers_url":"https://api.github.com/users/geoffhumphrey/followers","following_url":"https://api.github.com/users/geoffhumphrey/following{/other_user}","gists_url":"https://api.github.com/users/geoffhumphrey/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffhumphrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffhumphrey/subscriptions","organizations_url":"https://api.github.com/users/geoffhumphrey/orgs","repos_url":"https://api.github.com/users/geoffhumphrey/repos","events_url":"https://api.github.com/users/geoffhumphrey/events{/privacy}","received_events_url":"https://api.github.com/users/geoffhumphrey/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/milestones/15","html_url":"https://github.com/geoffhumphrey/brewcompetitiononlineentry/milestone/15","labels_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/milestones/15/labels","id":2293397,"number":15,"title":"v2.1.10 Release","description":"","creator":{"login":"geoffhumphrey","id":5216502,"avatar_url":"https://avatars3.githubusercontent.com/u/5216502?v=4","gravatar_id":"","url":"https://api.github.com/users/geoffhumphrey","html_url":"https://github.com/geoffhumphrey","followers_url":"https://api.github.com/users/geoffhumphrey/followers","following_url":"https://api.github.com/users/geoffhumphrey/following{/other_user}","gists_url":"https://api.github.com/users/geoffhumphrey/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffhumphrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffhumphrey/subscriptions","organizations_url":"https://api.github.com/users/geoffhumphrey/orgs","repos_url":"https://api.github.com/users/geoffhumphrey/repos","events_url":"https://api.github.com/users/geoffhumphrey/events{/privacy}","received_events_url":"https://api.github.com/users/geoffhumphrey/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":23,"state":"open","created_at":"2017-02-01T19:51:23Z","updated_at":"2017-07-20T13:21:34Z","due_on":"2017-07-31T07:00:00Z","closed_at":null},"comments":3,"created_at":"2017-07-17T20:24:30Z","updated_at":"2017-07-20T16:17:15Z","closed_at":null,"body":"A significant vulnerability in the authentication system of BCOE&M was reported in #740\r\n\r\n@geoffhumphrey and I emailed when it was reported and came up with what sounded like a good solution to the problem which involved\r\n\r\n* For installations of BCOE&M that have php's email() functionality enabled, modify the BCOE&M code to email a user's new password to them instead of displaying it to them on the website\r\n* For installations of BCOE&M that don't have php's email() functionality enabled, display a message to users trying to reset their password that they need to contact that administrator to do a password reset\r\n\r\nI indicated \"I think this would be a good interim tradeoff as it protects the installations and the users and introduces pain for folks hosting it on systems that can't send email. I think that would be a good security/convenience trade off.\"\r\n\r\nHe agreed that he'd put the change in for \"the next release.  Based upon the current codebase, it will be a pretty easy fix.\"\r\n\r\nA few weeks back @geoffhumphrey indicated that instead the release would have \"[22 newer and \"stronger\" questions](https://github.com/geoffhumphrey/brewcompetitiononlineentry/issues/740#issuecomment-312678930)\".\r\n\r\nIncreasing the number of security questions does little to mitigate this risk as it doesn't prevent users from choosing weaker security questions with brute forceable answers. In any normal website, having a weak security question (e.g. What is your high school mascot?) is not a big deal because the attacker must gain control of the victims email account in *addition* to guessing the answer to their security question. The security vulnerability originally reported in #740 however calls out that BCOE&M works fundamentally differently and does not enjoy this added protection.\r\n\r\nPlease complete and release either version 2.1.10 or a security point release in advance of 2.1.10 in the next 30 days (before August 17, 2017) with the proposed change of emailing users their newly reset password (in addition to or instead of an increased number of security questions) so that it's no longer possible for a users new password to be displayed on the site. If this doesn't happen I have an obligation in the interest of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) to publish this vulnerability in order to protect the users of BCOE&M."},"comment":{"url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/comments/316754437","html_url":"https://github.com/geoffhumphrey/brewcompetitiononlineentry/issues/788#issuecomment-316754437","issue_url":"https://api.github.com/repos/geoffhumphrey/brewcompetitiononlineentry/issues/788","id":316754437,"user":{"login":"geoffhumphrey","id":5216502,"avatar_url":"https://avatars3.githubusercontent.com/u/5216502?v=4","gravatar_id":"","url":"https://api.github.com/users/geoffhumphrey","html_url":"https://github.com/geoffhumphrey","followers_url":"https://api.github.com/users/geoffhumphrey/followers","following_url":"https://api.github.com/users/geoffhumphrey/following{/other_user}","gists_url":"https://api.github.com/users/geoffhumphrey/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffhumphrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffhumphrey/subscriptions","organizations_url":"https://api.github.com/users/geoffhumphrey/orgs","repos_url":"https://api.github.com/users/geoffhumphrey/repos","events_url":"https://api.github.com/users/geoffhumphrey/events{/privacy}","received_events_url":"https://api.github.com/users/geoffhumphrey/received_events","type":"User","site_admin":false},"created_at":"2017-07-20T16:17:15Z","updated_at":"2017-07-20T16:17:15Z","body":"Excellent point. In the next commit and release, the option to email the security question response will be removed and messaging will indicate to the user that if they cannot remember their response they should contact a site admin. That should button things up."}}
{"actor":{"display_login":"geoffhumphrey"}}