5 ms·
Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.
by laurent123456 8y ago
Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.
- mirimir 8y agoWell, that did protect users from his site, at least :)
- eganist 8y agoSounds like a fix. By the terms of the VRP it sounds like the reporter is owed a payout.
- kerng 8y agoBounty deserved, yes. Fixed? No, they only blocked his address, anyone else can still grab your info on their sites.
- lallysingh 8y agoLooks like it's blocked for everyone now
- Buge 8y agoIt's blocked for people who aren't on the whitelist.
- kerng 8y agoThat is interesting, do you have more info? I'd imagine the whitelist being quite enormous!
- Buge 8y agoI don't have any information besides what I've seen posted the comments here. For example this: https://twitter.com/sirdarckcat/status/994867632355577862 https://twitter.com/sirdarckcat/status/994867632355577862
- acqq 8y agoExactly. If it was about "just whitelisted partners" he discovered it was actually "everybody." It's not different than discovering that instead of the password just an empty string is enough.
- jacquesm 8y agoShoot the messenger. SOP. Maybe someone should tip off Google project Zero about this? Let's see if they mean it that they will hold themselves to the same standard.
- lavelle-harris 8y agoProject PR exercise? doubt it, they only seem to pick holes in other companies software, if they ever took a long hard look at Android for instance then I imagine they could find a ton of problems, which is probably why they haven't, at least to the best of my knowledge.
- pred_ 8y agoLooks like they took it down for everyone [0]; maybe not the most elegant approach but at least it seems they're taking it more serious now. [0]: https://stackoverflow.com/questions/50289065/google-yolo-stop-working-the-client-origin-is-not-permitted-to-use-this-api https://stackoverflow.com/questions/50289065/google-yolo-sto...
- jacquesm 8y agoIt would be very interesting to see a split second exact timeline on this.
- pred_ 8y agoIndeed. A Google engineer stated on Twitter [0] that the shutdown of the service happened because apparently YOLO is only supposed to be accessible to whitelisted partners. [0]: https://twitter.com/sirdarckcat/status/994867632355577862 https://twitter.com/sirdarckcat/status/994867632355577862
- jacquesm 8y agoSo, whitelisted partners get the ability to rip your data? I'm sure that will go down just fine. FB just got into a lot of trouble over something like that (arguably a lot more serious, but still).