WebApp Sec mailing list archives
Re: Social Security Number in Hidden field
From: Antti Virtanen <Antti.Virtanen () solita fi>
Date: Mon, 24 Nov 2014 07:11:25 +0000
For a similar reason I have also implemented such a feature once. The customer was fully aware that the information is not really safe, but they wanted to prevent casual observer from seeing such information. In modern office environments the observer doesn’t need to be in close proximity and I think this is a valid concern. In my case the sensitive fields were “encrypted", but with a weak algorithm. Vulnerable to a malicious admin or MITM, but this was the least worry in such scenario. -- Antti Virtanen Software Architect On 24/11/14 06:31, "Lorne Kates" <lkates () gmail com> wrote:
I once coded an admin page like this. Admins had to have access to SSNs (or SIN, since it was a Canadian company) of applicants. But they didn't want the SSN on the screen all the time. So a button was added that de-masked the SSN when clicked. The company was fully aware that visually hiding the SSN still meant the information was on the page, in the HTTP request and response, in View Source, etc. The only thing they were worried about was casual shoulder surfers seeing an SSN that they shouldn't. The only time someone would reveal it was if it was needed, and only then if they were the only ones looking at the screen. The field was also editable. It was blank when filling out a new form, and had a masked SSN otherwise (but if revealed, could be edited) This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------
Current thread:
- Social Security Number in Hidden field Jyotiranjan Acharya (Nov 23)
- Re: Social Security Number in Hidden field Robin Wood (Nov 23)
- Re: Social Security Number in Hidden field snipe (Nov 23)
- Re: Social Security Number in Hidden field Abhay Rana (Nov 23)
- Re: Social Security Number in Hidden field Lorne Kates (Nov 23)
- Re: Social Security Number in Hidden field Antti Virtanen (Nov 24)
- RE: Social Security Number in Hidden field Jeffory Atkinson (Nov 24)
- RE: [EXT] RE: Social Security Number in Hidden field Hambleton, Robert F (Nov 24)
- Re: Social Security Number in Hidden field snipe (Nov 23)
- Re: Social Security Number in Hidden field Robin Wood (Nov 23)