3 ms·

The story is incomplete. The user can’t read those channels, but the app someone may have used his credentials to authorize did. Google Workspaces have the same

The story is incomplete. The user can’t read those channels, but the app someone may have used his credentials to authorize did. Google Workspaces have the same problem with adding “backup” apps. It’s a broken authorization model. We also don’t know where the tokens came from, they could have just been leaked literally anywhere else. If I were Disney, I wouldn’t consider it “case closed.” If I were you, I would focus on what you can affect. I am sure a motivated party can use the multiplayer code you’ve authored to manipulate a remote player’s computer. There’s nothing to say here besides software is riddled with security holes and egos too big to concede obscurity is the most important defense.

lionkor 2y ago
Yes, I'm sure our code allows various exploits. It's open source though, and we try our best - that's really all we can do since we're volunteers and the project is not commercial, and none of us get paid. All the money we generate indirectly (i.e. through offering a multiplayer experience) goes to BeamNG themselves via game sales, who sadly also refuse to speak to us. All direct donations go to keeping our infrastructure up, and the rest is saved up for rainy days. We can't hire security researchers, not if they wanna get paid ;)