4 ms·
I'm struggling to reconcile this: > This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is
by haswell 3y ago
I'm struggling to reconcile this:
> This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice.
Against this:
> 15M email addresses
While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration.
I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
- danpalmer 3y agoFWIW, I'm trusting the public statement from Trello here. They could be wrong, but given that the data doesn't appear to contain anything new (like Trello passwords), it seems plausible. I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
- transcriptase 3y agoPerhaps they could notice 15m requests with a CTR of 0.0000000% Which is surely far below the CTR one would expect for people actually using the share feature on Trello.