3 ms·
Almost all flaws are "not that serious" on their own, because people aren't generally _that_ dumb. "You can find out somebody's account ID" isn't that big a pr
by annabellish 8y ago
Almost all flaws are "not that serious" on their own, because people aren't generally _that_ dumb.
"You can find out somebody's account ID" isn't that big a problem in the presence of other decent mitigations. Without those mitigations, of which HTTPS is one to prevent request spoofing, everything is terrible.
- deleted 8y ago[deleted]
- zip1234 8y agoI agree, the account ID is a complete non-issue as long as each endpoint limits results to the account ID associated with the credentials.