“Since Rabbit is acting as a third-party, and doesn’t use a standard like Oauth or SAML, it needs to keep user credentials in their original form. This is just insanely dangerous.”
Our reading, the sentence that was checked:
Rabbit must store user credentials in original form, which is insanely dangerous.
Assessment: Contradicted Evidence as of
Where and when Ed Zitron wrote it
Where's Your Ed At, Expectations Versus Reality, paragraph 34.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment wyea-expectations-versus-reality-4c2cab-a3
We recorded 28 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2024-05-13. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- doesn’t use a standard like Oauth or SAML
- needs to keep user credentials in their original form
- insanely dangerous
Our interpretation
- In the surrounding discussion of password hashing, original credentials means recoverable usernames and passwords, including reversibly encrypted passwords. It does not mean session cookies.
- Assess the technical assertion about retention. The phrase insanely dangerous is an evaluative description without a separate measurable threshold.
- Use the launch-period implementation from April 23 through May 13, the latest public operating period described by the post.
Counts as supported if: Implementation evidence shows that Rabbit retained recoverable original app passwords for subsequent operations.
Counts as contradicted if: Implementation evidence shows that Rabbit retained session cookies or tokens instead of original app passwords, allowing subsequent operations without keeping those passwords.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Contradicted
The dated evidence goes against what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
Obscurity Labs' April 29–May 10, 2024 inspection found that Rabbit collected service-issued session cookies for storage, rather than the usernames and passwords entered during login [e1](https://www.obscuritylabs.com/resources/blog/rabbit_pentest). This contradicts the asserted need to retain original app passwords for subsequent operations [e1](https://www.obscuritylabs.com/resources/blog/rabbit_pentest).
Limitations
- The inspection covers part of the April 23–May 13 target period; the report became available on July 30, 2024.
- The commissioned assessment excluded testing of the secrets vault itself and does not establish that Rabbit's entire system was secure.
Evidence (1 item)
Goes against the claim: Obscurity Labs,
isn’t what is being collected and stored.
Why it matters here: The report describes inspection during April 29–May 10; the event date marks that testing window's end. It found that service-issued session cookies, rather than entered usernames and passwords, were collected for storage.
- Publisher
- Obscurity Labs
- Kind of source
- Independent measurement
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Where's Your Ed At, Expectations Versus Reality
Since Rabbit is acting as a third-party, and doesn’t use a standard like Oauth or SAML, it needs to keep user credentials in their original form. This is just insanely dangerous.
- Where
- paragraph 34
- Published
- 2024-05-13
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment wyea-expectations-versus-reality-4c2cab-a3: Current. Outcome: Contradicted. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment wyea-expectations-versus-reality-4c2cab-a3.
HeldBy this site
The final-text check failed: citations_correct.
About assessment wyea-expectations-versus-reality-4c2cab-a2, which was not published.