8 ms·
Why does everyone seem to make the same mistake? DO NOT roll your own crypto.
by 0x8BADF00D 8y ago
Why does everyone seem to make the same mistake? DO NOT roll your own crypto.
- trhway 8y agowhile i suspect a couple layers/points, i can't zero in on the major specific point of your sarcasm/humor. "The data was accessible from a public and exposed Firebase data repository, which was hardcoded in the app."
- stevenwoo 8y agoThe article mentions it was because their Firebase database was unsecured - meaning anyone who knew the url could get access to all the data. That was the default for a long time, and Firebase will send you email reminders if you keep it unsecured. The developer ignored the best practices mentioned in the Firebase documentation and the email reminders that come out once a week (I think).
- olliej 8y agoCrypto wasn’t involved - this was just a publicly available database of all their users. The crypto version of this I guess would be to store the plaintext copy of the encrypted content as metadata on the “encrypted” content? No amount of correct encryption or (in this case) API access policies saves you if you just publish all the data publicly