5 ms·

There is a permission testing tool built in to firebase. And excellent documentation. This is 100% the fault of developers.

• azinman2 8y ago
  Perhaps knowing that humans are fallable and that many of these app devs are educated solely in a 2 month boot camp, Firebase might do something to make this less likely.
  • master-litty 8y ago
    Immediate suggestions that come to mind?
    • azinman2 8y ago
      Not allowing unauthenticated requests? Look for things like plaintext passwords from one of many giant dictionaries of commonly used passwords and flag that behavior? Look for fields that match credit card numbers? Do better in documentation, especially around any schema creator? I don’t know enough about the exact security problem (I don’t use firebase) but I’m guessing tossing your hands in the air isn’t the only option.
• rhizome 8y ago
  But just to be clear, Firebase defaults to open permissions.
  • davideast 8y ago
    No it does not. By default it locks down your empty database to only authenticated users.
    • rhizome 8y ago
      You know what I mean: open to all authenticated users, authentication being cleared at the app level. Only having to create an account for full access to all data is indeed "open." Would that Facebook used this strategy, the implications would be clear.