41–50 of 502 posts
Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?
Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.
I wonder how they noticed. Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.
Conrad said the breach was detected by a provincial employee, but it was a fluke.
“The employee was involved in doing some research on the site and inadvertently made an entry to a line on the site — made a typing error and identified that they were seeing documents they should not have seen,” Conrad told a technical briefing.
[0]: http://toronto.citynews.ca/2018/04/11/halifax-police-probing...
Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?
Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?
Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.
If you know the hash, you likely already know the file.
Since this is publicly accessible, what would be the chance that search engines indexed the files? In this case, would Google bot be charged? Or if this were, say, Equifax or Facebook. I mean, in those situations, the companies were blamed for "the leak". It seems rather convenient to cherry pick the law to apply on this poor teenager.
Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.
Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?
This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?
They helped Geocoder.ca with their 4 year lawsuit: https://geocoder.ca/?sued=1
This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager)
did the weev ruling surprise anybody other than hackers?
It’s a shame that police departments think these “shock and awe” tactics are even remotely appropriate for dealing with non-violent suspects.
Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.
Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?
That is a haunting reflection of the state of affairs with regards to information and laws regarding information. Criminalizing the mere possession of information should be a tool only of the despotic and/or idiotic.
Of course, these clowns left "private" information accessible by public urls without identification, so we know that they're at least idiots.