
Myspace lets you hijack any account just by knowing the person’s birthday - happy-go-lucky
https://leigh-annegalloway.com/myspace/
======
apostacy
Myspace was an XSS playground. You could embed javascript into anyone's
profile, by leaving a flash applet (or for that matter a java applet) in a
comment, and having it do an openurl to a javascript: url, which would execute
in the context of the user viewing it.

I had fun replacing people's profile pictures after the page loaded, or
stopping all of that annoying background music.

It was also possible to capture someone's document.cookie, as late as 2008.

Good times...

~~~
maaaats
A Norwegian social site back in the days called Nettby ("net-city") also
allowed some html, but did it by just removing unallowed tags. I realised I
could write <scr<script>ipt>, and after it did the removal of the first script
tag I still had one.

This trick still works on surprisingly many sites. Allowing custom html is
_hard_ , so think long before rolling your own.

~~~
gboudrias
Honestly if it's comments, just use Markdown or something. No reason for your
users to have access to HTML.

~~~
joepie91_
And then this happens: [https://github.com/ChALkeR/notes/blob/master/Improper-
markup...](https://github.com/ChALkeR/notes/blob/master/Improper-markup-
sanitization.md)

~~~
maxvu
I think it's funny that JIRA knows how to prioritize the best of all the list.

~~~
joepie91_
I'm hoping that was sarcasm...?

------
cm2187
I took the habit of feeding fake random information to all websites asking too
noisey questions and keeping track of them in case I need them for recovery. A
website doesn't need my exact date of birth, at most it may need my
approximate age. It doesn't need my real name either, even if it wants to
deliver something to me, the address should be all it takes. It doesn't need
my real email address, all it needs is some email alias that I can delete.
Good practice for privacy, spam management and security since it is harder to
guess this information and to reuse it when leaked.

~~~
x32
So much this. I've never saw the need to do give information out like that. As
far as every website is concerned my DOB is 01/01/1990.

~~~
Siemer
I always use 1/1/1911 to shave off a few more of those precious microseconds

~~~
sverhagen
If so, did you then just compromise yourself?

------
Eiriksmal
Who owns MySpace now and why does the author's screenshots have varying typos?
The "email found" prompt changes from "...Please remeber [sic] update your
email address after you log in" to "Please remember to update your email
address after you log in."

Also, the real MySpace.com's account recovery for "I don't have access to my
email" is now taking you to a myspace.desk.com ticketing frontend and a screen
that looks nothing like the author's post.

Suspicious.

~~~
mrmondo
It’s another Murdoch ‘asset’ I believe.

~~~
rmason
Rupert Murdoch bought it for $580 million in 2005 and then sold it to Justin
Timberlake and Specific Media Group a few years later for $35 million.
According to their Wikipedia page Timberlake & Co sold it in 2016 to Time Inc.

[http://variety.com/2016/digital/news/time-inc-myspace-
viant-...](http://variety.com/2016/digital/news/time-inc-myspace-
viant-1201703860/)

~~~
viraptor
The last trade is a shame. I saw the demo of MySpace around 2014 and found it
almost exciting. It was at the time when they were trying to make it all about
media consumption with transparent handover between devices and TVs /
computers. The tech looked quite fun. Looks like they couldn't get enough
interest to pull it off :-(

For some reason they were trying to get geeks at local meetups excited about
it. I got a can of MySpace-branded energy drink which was one of the weirdest
gifts...

------
thinkfurther
I remember a time where you could embed js and css in the forums. I never want
farther than seeing if I could steal my own login cookie (being new to js I
was sure I just _had_ to have overlooked something) and change posts of a user
without that user seeing that change haha (test user also being myself, in
some god forsaken part of the forum nobody used), then backed off that stuff
for fear of being banned and made little "utilities" like expanding text
boxes, and pretty stylesheets of course. There was just nooooobody paying
attention, I can absolutely vouch for that.

~~~
chrischen
I remember being able to get higher rates as a web developer/designer in high
school by being able to make special myspace pages that covered up the UI for
businesses.

~~~
dawnerd
Some of my first gigs/job were setting up new myspace layouts for indie bands.
Company I worked for had a custom player built and everything. I remember
finding some awesome hacks to make stuff work when myspace rolled out their
own player and tried to force it on everyone.

------
franciscop
In [https://help.myspace.com/hc/en-
us/articles/201989404-Forgot-...](https://help.myspace.com/hc/en-
us/articles/201989404-Forgot-Email-) they even spell "myspace.com" wrong...

~~~
sushid
Where? If you're referring to the capitalization, I think it's always been
"Myspace."

~~~
franciscop
It might have been removed/changed, but there was a wrong link.

------
rosariotech
Does MySpace still exists?

~~~
JoshGlazebrook
Don't expect there to be anything there from back when you actually used it.
They deleted all of your wall and private messages years ago.

~~~
13of40
I have mine in a zip file somewhere... They had an option to download it for a
while.

~~~
djsumdog
Yea I think I have mine somewhere as well. I really hate they removed all that
historical data though. They could have probably banked on a trickle of logins
simply from people looking for the nostalgia.

------
indigochill
I attempted recovering my ancient Myspace account just now claiming I'd lost
the email. I was directed to a Zendesk form that looked different from the one
shown in the screenshots. So looks like they might have changed the process
now?

------
sundvor
That's brilliant. :)

Apologies if snarky, but perhaps $15 on this would be well advised: (Humble
Bundle deal also on FP today)
[https://news.ycombinator.com/item?id=14791255](https://news.ycombinator.com/item?id=14791255)

Just bought the bundle; looking forward to learning more about security
myself. I would like to think I know the obvious things, but will probably
find big gaps if I get through all of it..

------
wodenokoto
Are birthdays part of the 360 million user account breach?

------
antihero
Also the amount of poor/broken English on that form and the dialogs makes me
suspect outsourcing.

------
wwwhatcrack
Oh no, I hope my Digg and Hotmail accounts are still safe.

------
shimon_e
No less secure than most people's bank accounts.

------
collyw
Myspace still exists?

------
WhiteOwlLion
What's MySpace?

