4 ms·

Probably an extreme case of paranoia on my part, but Domino's should probably close this as a vulnerability, right? If I knew someone's phone number I could po

Probably an extreme case of paranoia on my part, but Domino's should probably close this as a vulnerability, right? If I knew someone's phone number I could potentially use this to impersonate a delivery driver to gain access to someone (at a residential address or business)... I mean sure, I could just knock on a door or walk in impersonating someone else... but expecting a pizza delivery is different than ignoring/alerting someone to an unknown solicitor. OR you could also potentially use it to locate someone based on phone number by following a delivery driver from the local Domino's? You could also just use it to steal pizza. Just find the contact information of a bunch of people in a nearby condo building and wait at the door and say "Oh is that for John Doe? That's me, I'll take it"

TheSwordsman 10y ago
Depending on the location, you could just stand outside of the person's house and end up with an almost free pizza. Almost free because you shouldn't forget to tip the driver you're stealing the pizza from!
- azeirah 10y ago
  Tipping is not customary in many countries outside the US. Here in The Netherlands it would be free :D
- jabsters 10y ago
  Depends on the payment method. I haven't been able to pay for Domino's online.
rudolf0 10y ago
Should be pretty easy to fix. Just HMAC (or just concatenate pepper and hash, honestly) the phone number and use that as the identifier.
LyndsySimon 10y ago
... or, you could pull out a phone directory and get the landline numbers for everyone in a nice wealthy neighborhood. Wait until someone orders a pizza, and when the driver gets there you rob him. No connection to the neighborhood makes it very difficult to track down the perpetrator, and doing it in nice neighborhoods means that the driver is less likely to suspect trouble and more likely to be carrying cash.

TheSwordsman 10y ago

Depending on the location, you could just stand outside of the person's house and end up with an almost free pizza. Almost free because you shouldn't forget to tip the driver you're stealing the pizza from!

azeirah 10y ago
Tipping is not customary in many countries outside the US. Here in The Netherlands it would be free :D
jabsters 10y ago
Depends on the payment method. I haven't been able to pay for Domino's online.

rudolf0 10y ago

Should be pretty easy to fix. Just HMAC (or just concatenate pepper and hash, honestly) the phone number and use that as the identifier.

LyndsySimon 10y ago

... or, you could pull out a phone directory and get the landline numbers for everyone in a nice wealthy neighborhood. Wait until someone orders a pizza, and when the driver gets there you rob him. No connection to the neighborhood makes it very difficult to track down the perpetrator, and doing it in nice neighborhoods means that the driver is less likely to suspect trouble and more likely to be carrying cash.