Live data from Hacker News

Good Heavens 10M Impacted in Pray.com Data Exposure

threatpost.com

11–20 of 31 posts

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#11

> up to 10 million people > Subscriptions run anywhere from $50 to $120. Holy shit. And presumably it's all tax free. I wonder if there is some secret underground religious Venture Capital system that we don't know about.

> I wonder if there is some secret underground religious Venture Capital system that we don't know about.

https://www.wsj.com/articles/private-equity-backed-ministry-...

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#12
post #6

Every time I see an exposure like this I'm reminded of a couple things... 1. Security everywhere is an after thought. How many people have performed a threat analysis of the app they're working on? How many have management who will slow down velocity on features to put the time in to securing personal information? When the culture isn't there the training isn't there either. 2. I don't know if it's the case here but,…

Another, somewhat related issue is the fragmenting of teams. Having a few in-house devs, an outsourced team in Argentina, and a few other contractors, all coordinated by non-technical managers. This more or less describes all the projects I've worked on in my career and it creates the ideal conditions for security problems.

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#13
Given how common unsecured buckets and similar scenarios are and how widespread this architecture is, was there a time where less separation of cloudy concerns meant fewer opportunities to make mistakes and therefore fewer mistakes? Or is the rate the similar, but we just have many more companies creating this type of products these days?

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#14
post #3
post #2

From this we can safely assume their privacy approach was "lets pray no one will find our S3 buckets"

It would seem that `mysterious ways` was never the best security approach. Still to impact 10M users given "It has been downloaded by more than 1 million people on Google Play, and ranks as the #24 lifestyle app in the Apple App store" does seem interesting and would love a breakdown upon that as not sure that 9M Apple app users of this. So, probably some deeper breachers of GDPR and the like going on here.

"more than 1million" just means "1-10million" or whatever the bucket boundary is in the Play UI. Don't try to read too much specifics into these broad estimates.

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#15

> up to 10 million people > Subscriptions run anywhere from $50 to $120. Holy shit. And presumably it's all tax free. I wonder if there is some secret underground religious Venture Capital system that we don't know about.

There's no reason to assume it is tax free. You can find out.

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#16

> up to 10 million people > Subscriptions run anywhere from $50 to $120. Holy shit. And presumably it's all tax free. I wonder if there is some secret underground religious Venture Capital system that we don't know about.

The real value is in lead generation, getting contact info of gullible people with spare money.

Lots of dubious products are marketed to religious people, a segment that are easy to soon part with their money.

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#18
post #6

Every time I see an exposure like this I'm reminded of a couple things... 1. Security everywhere is an after thought. How many people have performed a threat analysis of the app they're working on? How many have management who will slow down velocity on features to put the time in to securing personal information? When the culture isn't there the training isn't there either. 2. I don't know if it's the case here but,…

I don't think it's possible for a sub-$1B consumer operation to be secure, unless they operate inside a very tight sandbox where all the data and processing live inside a Google/Apple/similar sandbox. If the data is managed by the vendor system (which includes most data-monetization plays), it's leaked. Security is too complicated and expensive to get right.

Re: Good Heavens 10M Impacted in Pray.com Data Exposure

#20

> up to 10 million people > Subscriptions run anywhere from $50 to $120. Holy shit. And presumably it's all tax free. I wonder if there is some secret underground religious Venture Capital system that we don't know about.

The real value is in lead generation, getting contact info of gullible people with spare money. Lots of dubious products are marketed to religious people, a segment that are easy to soon part with their money.

I wanted to downvote you for disparaging a massive sector of the population, although it is true that superstition is inevitably easier to peddle to people inclined to some form of mysticism. This said, there are plenty of equally "gullible" non-religious segments though ("bio/organic", homeopathy, fitness, diets, "goop", etc etc...).
Post reply on HN