3 ms·
To be honest, its very hard to tell from the article. I get the feeling Uber is covering something up. The hacker definitely downloaded files, but Uber also as
by 013a 9y ago
To be honest, its very hard to tell from the article. I get the feeling Uber is covering something up.
The hacker definitely downloaded files, but Uber also asked him to download production data to confirm the hack (um, what?) Uber escalated the payout; the hack wasn't particularly interesting, but it was substantial, so who knows there. The hacker's communication was dodgy, but he eventually met in person, and the fact he didn't want to leave his house indicates a possible social disorder.
Their handling was poor, but this may just be a case of "hating uber because they're uber".
- daveFNbuck 9y agoUber's story doesn't make any sense. In what world does "you published your passwords on GitHub" get a response of "prove it by using them"?
- monocasa 9y agoIDK, it seems to fit the frat bro culture I've come to expect out of Uber. "Oh yeah? Then fucking do it then", seems fairly Uber.
- whack 9y agoIn any sufficiently large corporation, there are so many different accounts/credentials floating around, that it's hard for anyone to keep track of them all. It's possible that the engineering team may have already invalidated the credentials that were published on GitHub. It's possible that those credentials were actually a bait, meant specifically to distract potential hackers. Asking for proof is a very quick and easy (and sloppy) way to get around all of the above.
- daveFNbuck 9y agoPrivate user information isn't proof that valid credentials were published on GitHub. It would be faster and easier to ask for actual proof in the form of a link to a valid credential published on GitHub, and that would actually prove that they were published.