Return to Question

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011

What security experts say about this issue:

this is pretty bad

 

it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account

I decided to change my password via the my logins link, and was presented with this dialog:

Notice the lack of confirmation of current password.

I love that I can stay logged in to Stack Exchange sites permanently, but it worries me that someone could change my password without knowing my current password.

The confirmation email says:

The password to your Stack Exchange account has been changed.
(If you didn't do this, you should be worried.)

The link is to https://openid.stackexchange.com/user so would presumably need me to be logged in there (which I wasn't) to do anything about it.

P.S. This is related to but not duplicate of Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking, with both bugs stemming from lack of defense-in-depth here.

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011

What security experts say about this issue:

this is pretty bad

it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account

I decided to change my password via the my logins link, and was presented with this dialog:

Notice the lack of confirmation of current password.

I love that I can stay logged in to Stack Exchange sites permanently, but it worries me that someone could change my password without knowing my current password.

The confirmation email says:

The password to your Stack Exchange account has been changed.
(If you didn't do this, you should be worried.)

The link is to https://openid.stackexchange.com/user so would presumably need me to be logged in there (which I wasn't) to do anything about it.

P.S. This is related to but not duplicate of Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking, with both bugs stemming from lack of defense-in-depth here.