You may want to change your passwords and your mobile email address. Both were accessible.
Is that true that the passwords were revealed? All I saw was a reset link that I didn't click on.
Tumblr security hole (the gaping kind)
51–60 of 85 posts
Re: Tumblr security hole (the gaping kind)
#52I didn't know what Tumbler is and I created an account just to confirm the hack (the security hole is still there). But this got me thinking about another post at HN on how to market your site - I guess a blatant (fake?) security hole is one way to do it.
people would notice only if the site is already known or else nobody would care, but it would probably hurt the site than do good
Re: Tumblr security hole (the gaping kind)
#53Probably better to let Tumblr know first, then us. Edit: just confirmed that it works. Basically let's you search users by id or email then give you ability to change their email/reset password.
Interestingly, I've looked at your comment about 10 times and just now noticed that you transposed the 'm' and 'b' in Tumblr. :)
Whoops. Well they've done studies to show common typos don't affect the meaning too much. I've updated it though -
"Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe." - http://www.mrc-cbu.cam.ac.uk/~mattd/Cmabrigde/
Re: Tumblr security hole (the gaping kind)
#54Earlier quoted context omitted.
...and how many people have found it and not said anything? we've all used poorly secured admins here and there, but /admin seems particularly egregious.
...and how many people have found it and not said anything? Scary.
It was only open for an hour.
Re: Tumblr security hole (the gaping kind)
#55What the hell is Tumblr? And what happened to vowels?
You must be new here.
Re: Tumblr security hole (the gaping kind)
#56Re: Tumblr security hole (the gaping kind)
#57You may want to change your passwords and your mobile email address. Both were accessible.
hang on, they're storing passwords in the clear? really?
Re: Tumblr security hole (the gaping kind)
#58Earlier quoted context omitted.
It was only open for an hour.
No, it was only open and public for an hour. It could have been open for months, maybe longer.
It was the result of a change today, right before it hit Hacker News (so sayeth Marco of tumblr in the #tumblrs irc channel, anyway; I believe him).
Re: Tumblr security hole (the gaping kind)
#59Re: Tumblr security hole (the gaping kind)
#60Chalk one up for PHP!