interesting database problem
Posted on November 20, 2007
Filed Under Programming |
I discovered an interesting and perhaps disturbing database problem today in a database owned by a large company with very sensitive information in its archives. Apparently, there can be two identical usernames in this database, differentiated only by their separate passwords. Only the username and password are needed to authenticate, and there is no apparent way to keep totally unrelated users from choosing the same username. I currently have access to my own account, and another account that I should not be able to access (simply because I typed the wrong password… imagine that). I plan to call the CTO.
I guess it is unlikely to have a situation like this occur often, but my case proves it is possible. Given this oversight, I wonder what else might happen… for example, if I changed my password to match the other password for the account with identical username? Would it crash their web applications, or perhaps their database? Or would it choose one of the two accounts at random each time I logged in? Or, maybe it would notify me that "this username and password combination is already in use." That would add its own little note of irony, wouldn't it.
Comments
Leave a Reply
You must be logged in to post a comment.
-
welcome
You have entered 'start your head on fire,' housed at www.robertbeverly.com. 'start your head on fire' is the blog of Robert Beverly. It is not a very serious blog. Mr. Beverly writes most of the news items, but you will also see us (Debbie and Secretia) posting from time to time to clarify things. We are his "blog secretaries."
-
View Robert Beverly's profile
-
who?
Rather than publish a biography or ask Mr. Beverly to record his memoirs (which would be dull), we thought we would post a summary for anyone who was wondering. He said we should do something like this because that's what other people's blogs have on them. Mr. Beverly goes by Rab, which is a common name for Scotsmen and their dogs. We call him Mr. Beverly in person because we're trying to talk him into a raise, but you can really call him Rab. Rab drinks gallons of coffee daily and makes jokes that we usually don't understand. We laugh politely because he writes the paychecks for Debbie and I (he hired us both as blog secretaries back in October 2006... we didn't even know what a blog was before this). Mr Beverly goes to the gym a lot, which is why he doesn't have time to type in his blog entries, and he does all kinds of weird exercises like Kung Fu and Yoga (NEVER ask him about this unless you want to hear all about martial arts). He enjoys literary analysis and esoteric reading and games like "Go" (the ancient Japanese strategy game) and chess, not to mention those weird "role playing" and "strategy" games he designs himself, all of which account for why we do not to start conversations with him. (Secretia here... what the hell was wrong with Yahtzee, I ask you?!) We like talking about peekapoos and the best grocery store sales, but we don't get to talk about that here.
-
Categories
- 13th of the month
- Business and Investing
- Consulting
- Cool Technology
- countersales
- culture
- exercise and martial arts
- fitness and medicine
- Games and other stuff
- health
- In all seriousness
- Insurance
- law
- Mundane Mondays
- Music
- politics
- Programming
- Pronouncement
- Risk Management
- Saturday Satire
- Security
- Thursday Thamauturgy
- Uncategorized
- Writing