5 ms·

The key was taped to the outside of the door explicitly to be used by the customer though.

by zilti 3y ago

lamontcg 3y ago
No it wasn't intended for customer use, the customer wasn't supposed to be directly hitting that API. There was reverse engineering that had to happen before recovering the plaintext password. He was already someplace fairly iffy for him to be. It was much more like being on the front porch of a house you don't own and finding a key.
- eastbound 3y ago
  Enough with building comparisons. The vendor put the master keys of the main database in a publicly-accessible package. It’s insane. Of course the researchers tested the keys, to check whether it was true. If it can be proven that it was used for nefarious reasons, then ok for blaming him, but as far as we know, the researcher just used it to get convincing evidence and left the system. The company is to blame 100%, and the research should get an encouraging award for white-hat reporting. Not this.
  - lamontcg 3y ago
    If you're just a "researcher" and you're not a cop then your job isn't to get convincing evidence of anything.
    - eastbound 3y ago
      If you’re a company then your job is to keep our bank accounts safe. See, I can do it too. Now that we’ve made clear that no-one is doing its job, YES, free citizen should be able to try to poke into the awful security of corporate IT systems and report it in good faith without even spending a second dealing with trouble.
      - lamontcg 3y ago
        No it really doesn't work that way. Companies don't go around testing the physical security of the banks that they use. They rely on the legal system and insurance to deal with any failures that the bank has. The right to pen test businesses doesn't actually exist.
        SpaghettiCthulu 3y ago
        On what reasonable basis? Because it embarasses the company, possibly damaging their business? I say that the company reaps what they sow. They should be grateful. If an ethical hacker doesn't find it, eventually an unethical one will.
- DANmode 3y ago
  If that house (the app) was built inside my living room (my phone), then how does the analogy play out?

The key was taped to the outside of the door explicitly to be used by the customer though.

by zilti 3y ago

The key was taped to the outside of the door explicitly to be used by the customer though.

No it wasn't intended for customer use, the customer wasn't supposed to be directly hitting that API. There was reverse engineering that had to happen before recovering the plaintext password. He was already someplace fairly iffy for him to be. It was much more like being on the front porch of a house you don't own and finding a key.

eastbound 3y ago
Enough with building comparisons. The vendor put the master keys of the main database in a publicly-accessible package. It’s insane. Of course the researchers tested the keys, to check whether it was true. If it can be proven that it was used for nefarious reasons, then ok for blaming him, but as far as we know, the researcher just used it to get convincing evidence and left the system. The company is to blame 100%, and the research should get an encouraging award for white-hat reporting. Not this.
- lamontcg 3y ago
  If you're just a "researcher" and you're not a cop then your job isn't to get convincing evidence of anything.
  - eastbound 3y ago
    If you’re a company then your job is to keep our bank accounts safe. See, I can do it too. Now that we’ve made clear that no-one is doing its job, YES, free citizen should be able to try to poke into the awful security of corporate IT systems and report it in good faith without even spending a second dealing with trouble.
    - lamontcg 3y ago
      No it really doesn't work that way. Companies don't go around testing the physical security of the banks that they use. They rely on the legal system and insurance to deal with any failures that the bank has. The right to pen test businesses doesn't actually exist.
      - SpaghettiCthulu 3y ago
        On what reasonable basis? Because it embarasses the company, possibly damaging their business? I say that the company reaps what they sow. They should be grateful. If an ethical hacker doesn't find it, eventually an unethical one will.
DANmode 3y ago
If that house (the app) was built inside my living room (my phone), then how does the analogy play out?