3 ms·
It looks like someone just scraped all of the public profiles.
by jtokoph 6y ago
It looks like someone just scraped all of the public profiles.
- bloudermilk 6y agoYup, this seems to be the case. I don’t know how this could be characterize as a leak?
- eswat 6y agoIt's definitely a grey area here. Clubhouse strongly encourages using real names on their platform. That can be considered personal information that should be protected by security controls that they seem to lack, based on what others have mentioned here, that could have limited this "leak".
- Zealotux 6y agoIt looks more like a SQL dump to me. The data doesn't seems to be too critical however.
- frombody 6y agoIf I were collecting a large amount of data, I would most likely store it in a database.
- eurasiantiger 6y agoActive data yes, archived data goes into the warehouse.
- tW4r 6y agoHow so? It is exactly the data you see when you open any clubhouse profile in the app Almost as if there was an endpoint /profiles/id that someone just scrapped by using id 0..9999999999
- vidarh 6y agoOne of the first places I worked they had that. For private data. Guess their user id and you could get someones whole contact list, access their voicemail, or start a 30 person conference call which could dial out internationally with calls billed to the affected user... The entire top management had user ids below 100... I found the problem because on login all it set was a cookie with the userid, and so of course I tried changing it. When I alerted my manager to the problem they put in place 'encryption' of said cookie. It was base64 encoding. They were shocked when I broke that too. Writing this now it sounds invented, but it's not. To be fair this was more than 20 years ago, and a lot of developers did not yet have any understanding of security, so they at least had a shred of an excuse. I left that company first chance I got.
- Cheezmeister 6y ago> 'encryption' of said cookie...It was base64 encoding. Made me chuckle.
- vidarh 6y agoI never figured out what thought process led to them considering base64 a security feature. I mean, I could tell just by looking at the cookie it was base64, but I expected that meant they'd encrypted it and then base64 encoded the result. But no. It made me treat every bit of code I was handed with extreme caution.