Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

501–510 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#501

Post by munk-a »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

> started grilling me about how many other plans I browsed

I think as soon as anything healthcare adjacent comes up most people will feel the need to get very nosey about what you accessed. It's possible they would have needed to file an incident (though, honestly, they should've regardless of what the reporter responded with) and gone through some procedure.

It's unfortunate the guy was a dick about it - but asking the extent of the data you accessed probably isn't unreasonable and may have been legally mandated.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#502

Post by ajmurmann »

websap wrote: post #352
joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

We live in a world where everyone thinks they understand computers and have an expectation of security and privacy, but they don't realize how hard it is to build these systems correctly. The best security appears to be invisible to the consumer, but requires a lot of thought by the implementer. This is the same reason why I think most of the general public don't understand how much data social media apps can collect…

> I'm not a mobile developer, but it would be interesting if iOS provided a service that allowed data to never leave the phone

I'm not sure I follow. Do you mean the app wouldn't be allowed to send any data over the network? As soon as the app can send any data, it's trivial to hide in there whatever the app wants to send home.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#503

Post by dylan604 »

theandrewbailey wrote: post #444
dylan604 wrote: post #383

Earlier quoted context omitted.

websites attempting to poorly comply with cookie banners and other GDPR regs that block a site from working without accepting something. I just display:none the offending elements and then remove the overflow:hidden. Disabling JS usually works, but sometimes the images in the page are lazy loaded via JS and will not load without.

FYI, that's not the View Source feature.

No, but it's infinitely more useful. All of those SAP that has 4 lines of HTML when View Source is used, but the Inspector shows exactly what elements are currently in the DOM that have been loaded by JS. Of course, you're aware of that just like I'm aware of the difference in tools.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#504

Post by invisible »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

What's bonkers is that _your own data_ was also accessible. Who's to say other users didn't get that data and choose to not report and kept the data?

Your own outrage to your data being exposed would have been perfectly reasonable.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#505

Post by decebalus1 »

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

Welcome to the club. The tipping point for me was the politization of Covid.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#506

Post by jjk166 »

kelnos wrote: post #400
klyrs wrote: post #166

Earlier quoted context omitted.

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Accessing data that you are not authorized to view is still wrong. The fact that someone has misconfigured the access controls doesn't change that. I might forget to lock my front door one day, but that doesn't make it ok for you to wander into my house and look at all my stuff.

Well in this case I'm knocking on your door and you're opening the door saying "Come right on in!"

Requesting access (ie knocking on a door/typing a url) is not illegal. If you grant that request (ie invite me in/serving a webpage), I am under no obligation to psychically infer that you didn't mean to and refuse your invitation.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#507

Post by kirlfiend_grill »

watchdogtimer wrote: post #494
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I found a similar vulnerability in one of our vendors' online order system. I noticed after placing an order an integer in the order confirmation page URL. I reduced it by one and refreshed the page. Sure enough, I got all the order details of the previous customer's sale. Reducing _that_ URL by one got the next previous sale details etc. I notified the company about it. They fixed it, and in gratitude sent me a smal…

I let a company know that the url for their receipts (including name, address etc) was simply an md5 of the order number. They graciously offered 15% off on my next order as a thank you.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#508

Post by Muromec »

klyrs wrote: post #166
mcguire wrote: post #148

Earlier quoted context omitted.

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

It's not the point. Of course they built stupidly insecure system, and of course sending people to jail for finding out such holes is wrong, but on the other hand ethical person should stop their access to personal data which they are not supposed to see after confirming that vulnerability exists and not make copies of said data.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#509

Post by mcguire »

klyrs wrote: post #166
mcguire wrote: post #148

Earlier quoted context omitted.

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Because you can do a thing does not mean you should do a thing.

If the security system is broken and you do exactly what it should be preventing, then you report it and get upset because they ask questions about you doing exactly what you did?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#510

Post by dragonwriter »

Spivak wrote: post #442
dragonwriter wrote: post #286

Earlier quoted context omitted.

> In real life, if you do it under false pretenses, you are. Sure, but how is that relevant? What material false representation was made which was relied on in deciding to provide the data?

Because servers don't decide anything. They're autonomous systems imperfectly carrying out the will of humans who make the actual authorization decisions. If a computer system erroneously prints an extra 0 on a check mailed out to you that doesn't mean you get to keep the money because the computer isn't the entity that decides how much money you're owed.

> Because servers don't decide anything.

If there was no decision, much less one based on materially false information, there can be no charge related to false pretenses. Your argument against decisionmaking is an argument against your claim of false pretenses.

> If a computer system erroneously prints an extra 0 on a check mailed out to you that doesn't mean you get to keep the money because the computer isn't the entity that decides how much money you're owed.

That's neither entirely true nor at all relevant to your false pretenses claim.

Post reply on HN