Re: Social Security Number in Hidden field

I can=E2=80=99t think of a single legitimate reason why SS=23 should be i=
n a hidden field.

As to whether it=E2=80=99s a security risk, that depends on whether the i=
ntranet app is accessible from the outside world, whether it runs over SS=
L, etc. Does the hidden field only show up for admins=3F Given what seems=
 like it might be lazy coding, I could imagine a scenario where if you=E2=
=80=99re not an admin, the hidden field doesn=E2=80=99t necessarily show =
up, but if you manually submit a SS=23 (via browser source editing or CSR=
=46), it might not check for admin status before changing data on the bac=
kend.=C2=A0

--=C2=A0

</snipe>
snipe=40snipe.net=C2=A0
=40snipeyhead on Twitter

snipe.net =7C snipeitapp.com =7C crankyhaiku.com =7C socialmediadouchebag=
.net =7C tumblr.snipe.net =7C downworthy.snipe.net=C2=A0

=22If we wish to count lines of code, we should not regard them as 'lines=
 produced' but as 'lines spent.'=22=E2=80=93 Edsger Dijkstra



On November 23, 2014 at 6:20:07 PM, Robin Wood (robin=40digi.ninja(mailto=
:robin=40digi.ninja)) wrote:

> Is there any reason for the SSN being included in the page=3F Is it
> used, i.e. can it be edited on the page=3F
> =20
> If not it shouldn't be there by the sound of it.
> =20
> Robin
> =20
> On 23 November 2014 at 20:12, Jyotiranjan Acharya
> wrote:
> > Hello,
> >
> > There is an application which is present in an intranet. When, the
> > Admin of the application loads the user information page, a field
> > called SSN appears. It shows =23=23=23-=23=23-=23=23=23=23. But the a=
ctual SSN remains
> > in a hidden field.
> >
> > Do you think there should be a security issue with this =3F
> >
> > Regards
> > Jyoti
> >
> >
> >
> > This list is sponsored by Cenzic
> > --------------------------------------
> > Let Us Hack You. Before Hackers Do=21
> > It's =46inally Here - The Cenzic Website HealthCheck. =46REE.
> > Request Yours Now=21
> > http://www.cenzic.com/2009HClaunch=5FSecurityfocus
> > --------------------------------------
> >
> =20
> =20
> =20
> This list is sponsored by Cenzic
> --------------------------------------
> Let Us Hack You. Before Hackers Do=21
> It's =46inally Here - The Cenzic Website HealthCheck. =46REE.
> Request Yours Now=21
> http://www.cenzic.com/2009HClaunch=5FSecurityfocus
> --------------------------------------
> =20




This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------