2

Changing a password for the admins or a customer requires the "current admin password."

That will require every admin to set memorable passwords, that have possibly been used in other sites, as opposed to using the corporate password manager, which does work with the login screen, but not in the random other backend screens through magento.

Update: It appears to be a bug with the form field, as Github currently features a password entry form when adding a new public key. In that form no username is required, but chrome allows you to choose a password to use. As such, eliminating the password reuse problem present in Magento.

Improve this question
6
  • 2
    No answer so just as a comment. I can only discourage that change as it's a major security feature to re-authenticate your admins to avoid some CSRF attack which could change user password from an attacker and the admins would not even notice that. owasp.org/index.php/…
    – Tobias
    Mar 26 '15 at 15:26
  • @TobiasZander While I agree that it is a layer of security, the nonce should be enough to stop CSRF's. I wish they had implemented the reauth as a login screen, so that password managers could handle it. Right now the feature adds a layer of security by creating a potential security hole, password reuse.
    – Ray Foss
    Mar 26 '15 at 15:34
  • What do you mean with nonce? If it's automatically handled by a password manager it's again open for CSRF btw, except that at least the loginscreen pops up for a short time ;)
    – Tobias
    Mar 26 '15 at 15:47
  • owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 nonce is the first listed defense option. Magento uses it. If the magento login screen pops up without the sheriff intending to go to the admin panel, that would seem highly suspicious to the user.
    – Ray Foss
    Mar 26 '15 at 16:06
  • Thanks for clarification, didn't know the word nonce, familiar to me as one-time-token, which unfortunately only helps if that cannot be revealed by XSS ;)
    – Tobias
    Mar 27 '15 at 8:23
3

As of at least 1.9.2.x there is a setting Under "Configuration > Customers > Customer Configuration > Password Options" named "Require admin user to change user password"

Flipping it to no does exactly what you'd expect, it removes the "Admin password" requirement when changing the password of customer accounts. This is presumably to allow for stronger admin passwords using a password manager.

That setting will not work on the passwords of backend users, only customers. That's probably all that most of us need.

Improve this answer
2

As mentioned by Tobias already in the comments, I can only agree that removing this functionality is a bad idea.

Re-authentication for sensitive features is a security measure to prevent CSRF or session hijacking.

In Magento this was implemented in CE >= 1.9, but there are also implementations where other shops require a re-authentication on the frontend (before placing an order on Amazon, for example).

Otherwise an attacker could execute sensitive actions via CSRF or XSS without knowing the user's credentials or steal the users' session from the browser.

Improve this answer
3
  • I understand it is a layer of security to guard against zero days and bugs, but it opens a massive security hole in the form of password reuse. In essence, anyone currently using 1.9 has all their employees using a rememberable password that they likely set... making it easy to social engineer customer service passwords etc. At this moment, my concern is not CSRF or XSS, it is password reuse. All three are huge issues, nonces are effective at killing CSRF, a content security policy is effective at killing XSS, password managers are effective at killing password reuse.
    – Ray Foss
    Mar 31 '15 at 15:02
  • 1
    I am not completely sure about your password issue. There are a lot of good passwort managers out there that let you choose which passwort to fill into a form. I think this is more an issue of your passwort management/manager than Magento.
    – Anna Völkl
    Mar 31 '15 at 15:11
  • At this time, neither Firefox nor Chrome's password manager support the password field in magento's customer or admin user's screen. An Amazon like implementation would be practical and fix the issue. Though, at this time, it is a feature I can live without out... specially since this is only in the admin panel, which is somewhat easy to secure separately as it need not be public.
    – Ray Foss
    Mar 31 '15 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.