4 ms·
You scored some internet points.. But posting this before the company could react, smells of bad taste, and won't score you much respect.
by dncornholio 5y ago
You scored some internet points.. But posting this before the company could react, smells of bad taste, and won't score you much respect.
- gamblor956 5y agoIt's not just bad taste. Some of the described actions would legally be considered fraud (both in the U.S., and in France where the author and app are based).
- deadf00d 5y agoLike what ?
- encryptluks2 5y agoI mean in the US, you have the CFAA and in France a quick Google search indicates the illegalities of doing something like this. I wouldn't be surprised to see the company go after you and to be questioned by law enforcement. Don't say no one warned you.
- deadf00d 5y ago"illegalities of doing something like this" -> Like what ? Maybe you can provide sources ?
- dncornholio 5y agoTrying to do a crime is punishable. Your blogpost is one big confession on how your tried to hack a company out of money. No?
- gamblor956 5y agoFraudulently recording steps, and the other example of you gave making calls to the API. Legally, those API calls signify something in the real world. You are representing that the action/status signified by the API call happened in the real world. _It's one thing to accidentally or mistakenly call those APIs, but to do so deliberately if such action/status is not true is fraud. By itself, that the API calls are fraudulent wouldn't matter. But in your case, the purpose of the fraud is financial gain: each API call earns you money. In the U.S., this would be (felony) theft by fraud, among other crimes. French laws are more complicated, and as I'm not French nor do I speak French I won't attempt to go into any detail as to what the specific crimes would be, other than to say it appears that your actions, if performed, would appear to constitute several different crimes. [Note that in the U.S., intent matters, so fake API calls for purposes of QA testing, security testing, etc., isn't fraud...but could be a crime if performed without the website owner's permission.]
- deadf00d 5y agoI don't think so. Take it as it is. A funny prétexte to speak about serious stuff. EDIT: I'm waiting for WeWard answer. And will help them fix stuff presented in this article.
- floodyberry- 5y agoYou're supposed to tell them it's broken before you tell everyone else it's broken
- Gepsens 5y agoÇa fait pitié.
- MisterSandman 5y agoYou should honestly take this post down. You've literally revealed how to gain access to their API keys, mentioned that it can be used to devestate the company and commit fraud, then just added a message in parentheses asking the reader not to do it. This is a shitty article that isn't humorous at all. It would've been funny if you had reported it, they had fixed and you'd posted the article after. This reads like an engineer trying to get an ego boost and a pat on the back.
- orf 5y agoThe keys are already public, he’s not documenting some super secret zero-day way of extracting keys. He… downloaded the app and unzipped it, basically. Be angry at the company who clearly don’t have a clue how to secure anything.
- deleted 5y ago[deleted]
- MisterSandman 5y agoYou can be angry at both the company and the person who publicly revealed the issue without first trying to inform the company. That's literally white-hat-hacking 101. They keys may already be public (technically), but he is the one publicizing it and posting it on Hacker News. OP is also clearly aware of how much harm can be done using these keys, since he asks people to not use them.