1

I recently ran into an issue where the 'Change Password' form for a website allowed me to choose a long password (50+ characters), but the login form had a lower limit of 16 characters.

This means that it was not possible to log in with the password that I had just chosen using the official form. I ended up having to do a password reset and choose a shorter password.

I had a look at the HTML code using the browser developer tools (commonly known as 'Inspect Element'), and saw that there was a HTML 'maxlength' attribute on the form, set to 16 characters. This is a form of client-side input validation.

As far as I know, this input validation does not provide any actual security, it's just designed for user convenience and should mirror the real user input validation in the code on the server.

My question is whether removing this 'maxlength' client-side input validation myself using the browser developer tools in order to be able to properly enter my password could be considered an offence?

The main thing that would concern me with doing this is that on a poorly designed website, removing this input validation could cause a crash on the server side (i.e. by sending it more data than it is expecting). I guess it could also be 'Unauthorised Modification' of data, but I'm not sure since it's just the local HTML in my browser that I am editing, not the 'master' copy on the server.

0

It is not a violation per se. If the website would allow 20 character passwords, and there is a bug that limits them to 8, then removing the bug to pass your valid 16 character password is fine. If you remove the length checking code to pass 100 characters, that's not fine. It would be an attempt at computer misuse, and if it actually interferes with the operation of that computer, then it isn't an attempt anymore.

Now it's a bit stupid to create a website that can be hacked this way, but there is no law saying that this would make your interference legal.

Whether you are modifying just your local computer doesn't matter. It would indeed be very, very rare that someone would be modifying the actual computer where it is located. The problem is that your local computer would send commands to the server which could cause damage, because of your modifications.

  • Why would trying to give 16 characters, when the form only allows 8, not be a misuse, but if it's 100 characters it is all of a sudden considered a misuse? A very strong password could be 100 characters long. – Brandin Nov 15 '18 at 6:10
  • At least on the backend of some systems, backend maximums seem to be more like 255, 512, or even unlimited. So if you are trying to trigger a bug in the system (e.g. buffer overflow), you would realistically need to try larger numbers of characters. what is the max length of password on unix/linux system? – Brandin Nov 15 '18 at 6:13
0

My question is whether removing this 'maxlength' client-side input validation myself using the browser developer tools in order to be able to properly enter my password could be considered an offence?

You could be violating the Computer Misuse Act if it was broadly interpreted in your case. But more likely, you're simply violating the Terms of Service (TOS) of the site by modifying the password length field. Read the TOS of that site; it may have language that says any modifications of the site code, browser display, site functions or user interactions - including the (real or perceived) security of passwords, i.e. their length - is against the TOS.

The TOS may state that by simply using the site (or if you clicked through a clickwrap agreement) you have agreed to the TOS, and the site owners reserve the right to break your use contact if you violate the TOS, i.e. they can deny you their services and use of the site.

The main thing that would concern me with doing this is that on a poorly designed website, removing this input validation could cause a crash on the server side (i.e. by sending it more data than it is expecting).

It's extremely unlikely you're going to cause a buffer overflow in a server side (or client side) script; popular web app code libraries have been sanitizing inputs for years.

0

I do not know where in the world you are. I have to assume you are in the UK, because of your reference to the Computer Misuse Act. This answer is intended to generalize a bit, by referring to the U.S. Computer Fraud and Abuse Act (with which I am more familiar).

I do not think the issue you would face would be because of the defacement of the client-side form validation, per se. Instead, the issue would be with what that defacement permits you to do. But the end result may be a violation of the site's Terms and Conditions of Use, and violation of the Ts&Cs may in turn amount to a violation of the Act.

Both the Computer Misuse Act and the Computer Fraud and Abuse Act make unauthorized access and attempts to impair the operation of a computer unlawful. The CFAA has been interpreted to include exceeding permitted access within the scope of unauthorized access. An argument could be made that, to the degree changing the client-side validation permits you to change your access to the system, it could lead to attempted or actual violation of the Act. For instance, although it is a tragically stupid one, the proprietors of the website may believe that client-side validation is effective in limiting malicious uses of the site. If so, even though it does not actually permit malicious activity, using the site without permitting the client-side validation could exceed the acceptable use of the site and therefore your level of authorized access.

Could this be prosecuted? It may depend on where both you and the affected computer systems reside. For instance, in the U.S. Ninth Circuit, the CFAA is interpreted fairly narrowly with regard to "exceeding access". I would not anticipate it would be considered a violation there. In the Seventh Circuit, the interpretation is much narrower. In Int'l Airport Ctrs. v. Citrin, for example, the Seventh Circuit held that an employee (soon to become ex-employee) exceeded his access when he erased files from a computer after deciding to quit. Erasing files as a loyal employee would not have been a violation. But because he had decided to quit, his agency relationship with the employer had terminated and with it his right to delete content from the computer (other access may still have been authorized). In other words, it can be a bit of a mess.

(I do not know anything about interpretations or likely interpretations of the Computer Misuse Act, and cannot speak to whether it is similarly a mess. I would be wary that it well may be. Also, note that both Acts claim to have extra-territorial application: you can violate the CFAA even if you are a U.K. citizen sitting in London, if the computer you are affecting is in the U.S.).

In my view, your best play in a situation like this one is to let the website operator know about the problem, ideally repeatedly and loudly until they start taking security more seriously. In the meantime, if you feel comfortable doing so or it is necessary, reduce your password length to something with less entropy. Aside from being too much trouble, it could be annoying or painful to remove the input validation. If the site will not mend its ways, and if you are not comfortable with a short password (or with the thought that the site may be so security unconscious that it finds the short password length acceptable,) stop using the site and loudly explain why you are doing so.

Incidentally, while I agree with everything in @BlueDogRanch's answer, it is worth noting that badly-written services sometimes rely on client-side validation as a bandaid for garbage code on the server side. I wish I had never seen it, but I have. So while in the general case it is correct that it should be impossible for you to cause a buffer overflow on the server because of bad input, "should be" may not be the same as "is".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.