• 1 Post
  • 52 Comments
Joined 2 years ago
cake
Cake day: July 15th, 2023

help-circle

  • The 12th Amendment provides that “no person constitutionally ineligible to the office of President shall be eligible to that of Vice President.” As such, anyone barred by the 22nd Amendment from being elected president is also ineligible to serve as vice president, and so a twice-elected president cannot return to power through vice-presidential succession.

    If a person is constitutionally “ineligible to the office of President,” they are also skipped over in the presidential line of succession under the Presidential Succession Act (3 U.S.C. §19), which prohibits anyone ineligible to serve as president from assuming the office.

    The ghouls in power currently don’t understand or don’t care, and by the time this is tested, it will likely be rubber stamped by the supreme court. But, there’s still value in understanding ahead of time that no, that is not a constitutionally valid approach.



  • Even if it didn’t outright display the code you need to enter, my guess is this and similar implementations hide further vulnerabilities like: the numbers aren’t generated with a secure random number generator, or the validation call isn’t resistant to simple brute force quickly guessing every possible number, or the number is known client side for validation, etc.











  • That’s correct, it is just plain text and it can easily be spoofed. You should never perform an auth check of any kind with the user agent.

    In the above examples, it wouldn’t really matter if someone spoofed the header as there generally isn’t a benefit to the malicious agent.

    Where some sites get into trouble though is if they have an implicit auth check using user agents. An example could be a paywalled recipe site. They want the recipe to be indexed by Google. If I spoof my user agent to be Googlebot, I’ll get to view the recipe content they want indexed, bypassing the paywall.

    But, an example of a more reasonable use for checking user agent strings for bots might be regional redirects. If a new user comes to my site, maybe I want to redirect to a localized version at a different URL based on their country. However, I probably don’t want to do that if the agent is a bot, since the bot might be indexing a given URL from anywhere. If someone spoofed their user agent and they aren’t redirected, no big deal.


  • User agents are useful for checking if the request was made by a (legitimate self-identifying) bot, such as Googlebot.

    It could also be used in some specific scenarios where you control the client and want to easily identify your client traffic in request logs.

    Or maybe you offer a download on your site and you want to reorder your list to highlight the most likely correct binary for the platform in the user agent.

    There are plenty of reasonable uses for user agent that have nothing to do with feature detection.