4 ms·

> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to pe

> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to performing actions on their own account. Could you clarify how is that supposed to create a fraudsters' paradise?

Nursie 5y ago
Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
- pbasista 5y ago
  Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well. That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
  - Nursie 5y ago
    Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.

4 ms·

> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to pe

by pbasista 5y ago

Nursie 5y ago
Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
- pbasista 5y ago
  Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well. That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
  - Nursie 5y ago
    Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.