5 ms·
How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them. It feels suspicious that someo
by ericmcer 7y ago
How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them.
It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.
- ThePhysicist 7y agoMaybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.
- LinuxBender 7y agoPerhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?
- awb 7y agoI'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.
- ljm 7y agoPlausibly a dev/debug hack that should never have made it into production. Either way, they wrote the functionality and it is shoddy work.
- Areading314 7y agoIt doesnt surprise me. One dev creates the endpoint for testing, leaves the company and the next dev does some refactoring and it makes its way to production. Many projects are done under a lot of time pressure. Also, often devs face worse consequences for a late project than for a catastrophic error.