Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I “found” the database of a college app (2018)

yoginth.com

Post reply on HN
Print view View original

11–20 of 107 posts

Re: I “found” the database of a college app (2018)

#11

Post by diericx »

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info.

edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!

Re: I “found” the database of a college app (2018)

#12

Post by anarchodev »

ggggtez wrote: post #3

Visible key isn't the bug. The bug is that the app should not have read access to other students.

Yep. Although this exact thing has happened to so many apps I’m beginning to doubt the wisdom of this “allow completely open dev settings at first and then YOU get to remember to fix it” model that fire base uses.

Maybe they could require an IP whitelist if the permissions aren’t set yet or something.

Re: I “found” the database of a college app (2018)

#13

Post by gchamonlive »

ggggtez wrote: post #3

Visible key isn't the bug. The bug is that the app should not have read access to other students.

permissions are a pain... i am considering centralizing permission handling in a separate service environment so that every service I have shares the same permission logic.

It is a shame since we could save some latency time by having permissions implemented in the same language and app that it is being requested. But to avoid stuff like that in the article I believe the cons are worth it

edit: the user had direct access to the database. No amount of code would mitigate that. Moral of the story is NEVER leave your database open to public, always hide it behind a service wall

Re: I “found” the database of a college app (2018)

#14

Post by evolveyourmind »

yoginth wrote: post #7
hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

I think we can't hide keys up to my knowledge! But make sure you just switched firebase to production mode. In my case, the firebase was in development mode and the data is available public! https://yoginth.com/college-hack#mitigations

It’s not about keys or modes, it’s about the rules they didn’t set up. Everyone uses firebase like that. Those “keys” are required to allow you to connect to the correct firebase app, nothing more. You don’t get any direct special permission to do things on the database or storage. Here some more info about the rules: https://firebase.google.com/docs/database/security

Re: I “found” the database of a college app (2018)

#18

Post by noja »

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

Read-only access through intermediate proxy that you control (but not to all data like here) + login required for more access (via intermediate proxy or direct).

Re: I “found” the database of a college app (2018)

#19

Post by rrix2 »

anarchodev wrote: post #12
ggggtez wrote: post #3

Visible key isn't the bug. The bug is that the app should not have read access to other students.

Yep. Although this exact thing has happened to so many apps I’m beginning to doubt the wisdom of this “allow completely open dev settings at first and then YOU get to remember to fix it” model that fire base uses. Maybe they could require an IP whitelist if the permissions aren’t set yet or something.

This is the cause of many mongodb and redis woes as well.

Re: I “found” the database of a college app (2018)

#20

Post by stedaniels »

kazinator wrote: post #17

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

I'm not sure if you are in the industry, but attendance tracking is high up on most institutions lists of metrics to track. Aside from helping out the usual back office data, it's often a key indicator for students who are in trouble. The institution can then reach out and assist these students.
Post reply on HN