4 ms·
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the c
by iancarroll 3y ago
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects.
A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase. I am not sure what happened to it after that.
- yismail 3y agoIf I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if user.email == collection.email.
- justrealist 3y agoDoing authorization within firestore breaks down instantly outside of toy applications.
- jacquesm 3y agoI think deleting a scooter is against some law of conservation :)
- singleshot_ 3y agoOne interesting thing about the statute of limitations is “the discovery rule.” For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right? No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until they do. Accordingly, if the scooter company read a post today about a hack that happened “a long time ago” and therein discovered their loss, the statute of limitations would begin to tick today and the hacker could be in legal jeopardy for two more years.
- henriquez 3y agoDoes this apply to criminal or just civil?
- btilly 3y agoGenerally it applies to both. But some crimes (eg murder) might not have a statute of limitations. https://www.law.cornell.edu/wex/statute_of_limitations https://www.law.cornell.edu/wex/statute_of_limitations Also there are subtle questions around what discovery means here. Usually it is some sort of "could be discovered with reasonable effort". If I had proof of your wrongdoing in a letter sent to me, I am unlikely to get away with saying, "Oh, I didn't read the letter when I got it." If that proof was buried in a computer file with a million pages, I probably can reasonably say, "That was a needle in a haystack, and I didn't even know what to look for." For situations between those extremes, there will be case law that likely varies by state. This is where a lawyer gets to earn their pay.
- singleshot_ 3y agoHuge arrow pointing to “varies by state” on all of this. 1030 (which is, of course, federal law) actually has a specific discovery/statute of limitations in the text of the statute, and so may not be affected by state discovery rule law.
- iancarroll 3y agoThe scooter company was well aware of it as I told them about that + several other issues immediately. :)
- singleshot_ 3y agoWell that makes me smile. I should have figured there was more to that story!
- dudus 3y agoIt is common. But before you curse at Google here. This is VERY well documented. When you create a database the UI screams at you that it's in dev mode, that security has not been setup etc.... if you keep ignoring the database will eventually close itself down automatically. So this is entirely on the dev team to blame.
- manicennui 3y agoWhich is why I hate that people keep claiming that you don't need to know what you are doing nor employ anyone who knows what they are doing to setup infrastructure. You might be able to stand things up without knowing what you are doing, but you probably shouldn't be running it in production that way.