3 ms·

While it's good to expose such a security issue why would he grab 1000 signatures and than share the script? What do white hat security researches think of that

While it's good to expose such a security issue why would he grab 1000 signatures and than share the script? What do white hat security researches think of that?

sneak 13y ago
Why would DHL publish -all- of the signatures on the web without even a rudimentary audit/security review? This is 2013. It's not about the "grab". The act is publishing, making available. Those who access are not the gatekeepers.
- squidi 13y ago
  Two wrongs don't make a right
  - sneak 13y ago
    It's not wrong to read something someone posted inside a window.
smcl 13y ago
I didn't even think of it as a security thing. A surname, signature and vague region in a country is not a particularly narrow combination. I was mostly just wanting to look at the signatures themselves - I'm not by any stretch of the imagination expert in breaking security. Any idiot could take a URL and increment a param in the URL. As to why I shared the script, I dunno I just figured others might find it interesting - though on reflection it's not particularly advanced.