5 ms·
"Embedded in the code was a file path labelled "get-admin-users." He simply copied and pasted that back into the URL bar, and then suddenly saw a list of admins
by cryptozeus 7y ago
"Embedded in the code was a file path labelled "get-admin-users." He simply copied and pasted that back into the URL bar, and then suddenly saw a list of admins, including their usernames and passwords."
Its almost like you were asking for it. I dont even keep plain text password on my local machine.
- willis936 7y agoWhy would anyone? The riskiest place I would keep passwords is in an encrypted archive. Barring unknown side channel attacks, my brain is less secure than that.
- ericmcer 7y agoHow is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them. It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.
- ThePhysicist 7y agoMaybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.
- LinuxBender 7y agoPerhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?
- awb 7y agoI'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.
- ljm 7y agoPlausibly a dev/debug hack that should never have made it into production. Either way, they wrote the functionality and it is shoddy work.
- Areading314 7y agoIt doesnt surprise me. One dev creates the endpoint for testing, leaves the company and the next dev does some refactoring and it makes its way to production. Many projects are done under a lot of time pressure. Also, often devs face worse consequences for a late project than for a catastrophic error.