A History of AppSec through Neopets.com

The talk opens with the speaker's own start in programming through Neopets, a browser-based virtual pet game popular in the early 2000s, and uses its long-running codebase as a lens on how web security has changed. It starts with the early login system, where passwords were stored without hashing and account recovery relied on weak controls, and notes that a 2020 source code leak exposed hardcoded database credentials.

The middle section covers account theft driven by a black market for rare pets, where older accounts with weak passwords were brute forced. A 2022 breach exposed usernames, emails and passwords, including unhashed passwords for accounts created before 2015. Neopets then adopted federated single sign-on, which also made it easier to monitor multiple accounts. The talk moves on to Flash, its security problems and end of life, and the Ruffle emulator, a Rust and WebAssembly rewrite that runs inside the browser sandbox. It then looks at user-editable HTML, which enabled HTML injection, clickjacking, phishing and cross-site scripting, and at bot defenses, where a simple image CAPTCHA is easy to bypass.

The closing section argues that legacy systems carry accumulated technical debt, and that the next major breach may come from an old, forgotten system rather than a new AI feature. The question and answer session covered the secondary market for items, brute forcing, and the site's ownership history.