Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

621–630 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#621

Post by Something1234 »

kirlfiend_grill wrote: post #507
watchdogtimer wrote: post #494

Earlier quoted context omitted.

I found a similar vulnerability in one of our vendors' online order system. I noticed after placing an order an integer in the order confirmation page URL. I reduced it by one and refreshed the page. Sure enough, I got all the order details of the previous customer's sale. Reducing _that_ URL by one got the next previous sale details etc. I notified the company about it. They fixed it, and in gratitude sent me a smal…

I let a company know that the url for their receipts (including name, address etc) was simply an md5 of the order number. They graciously offered 15% off on my next order as a thank you.

I feel like that would be a decent option for a surrogate key for public identification of an item and potentially cheaper than generating a uuid or something else. Maybe combine that with a salt and you have alright protection. How did you figure out that it was an md5 of the order number?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#622

Post by mike_h »

0xBA5ED wrote: post #89
jmull wrote: post #21

> Parson said...the reporter was “attempting to embarrass the state and sell headlines for their news outlet.” Literally a reporter's job.

The funny thing is, the reporter successfully embarrassed the state, then the state embarrassed itself further in response.

Parsons knew what he was doing, he won’t be embarrassed. It’s a Trumpian move to stir up resentment against the “liberal media” – not something meant to be evaluated critically.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#623

Post by cryptofistMonk »

Something1234 wrote: post #621
kirlfiend_grill wrote: post #507

Earlier quoted context omitted.

I let a company know that the url for their receipts (including name, address etc) was simply an md5 of the order number. They graciously offered 15% off on my next order as a thank you.

I feel like that would be a decent option for a surrogate key for public identification of an item and potentially cheaper than generating a uuid or something else. Maybe combine that with a salt and you have alright protection. How did you figure out that it was an md5 of the order number?

Presumably order numbers are easily guessable, so the md5 really offers no protection at all in this case and is no better than just using the order number

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#624

Post by Spivak »

alpaca128 wrote: post #607
Spivak wrote: post #432

Earlier quoted context omitted.

But this is assuming that the server has more agency than it does. Servers don't have minds and they don't make authorization decisions. This is more like someone giving you key to a filing cabinet in order to retrieve some documents and while you're there you snoop on the ones next to yours. Is this system more trusting of people than it should be? Probably. Does that mean you're allowed to snoop on other people's d…

> This is more like someone giving you key to a filing cabinet in order to retrieve some documents No. It's like someone asking you what you need, you telling them "I want all my documents and the ones from my neighbours because I feel like it", and them proceeding to hand you everything you asked for neatly collected in a folder.

You’re still ascribing agency and authority to a fancy vending machine. The server has absolutely zero authority to grant you authorization to the documents. It can only grant you access. The servers are not representatives of the government or the site-owners, they are just machines. And just because the vending machine is broken and works without you paying doesn’t make it not stealing.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#625

Post by karaterobot »

nonesuchluck wrote: post #106

Why is everyone here acting like the governor is merely stupid? He is not arguing from ignorance, he is arguing in bad faith. Mike Parson wants to feed the narrative that the American free press is the "enemy of the people" because it suits his politics, nothing more. The only message here is "be careful embarrassing fascists."

I think we're using Hanlon's Razor. All else equal, it's more likely he's merely ignorant than that he's trying to tear down the first amendment. Is there any evidence to the contrary?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#626

Post by renonce »

Something1234 wrote: post #621
kirlfiend_grill wrote: post #507

Earlier quoted context omitted.

I let a company know that the url for their receipts (including name, address etc) was simply an md5 of the order number. They graciously offered 15% off on my next order as a thank you.

I feel like that would be a decent option for a surrogate key for public identification of an item and potentially cheaper than generating a uuid or something else. Maybe combine that with a salt and you have alright protection. How did you figure out that it was an md5 of the order number?

Searching for that MD5 would probably be sufficient to find that out.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#627

Post by Spivak »

tremon wrote: post #550
Spivak wrote: post #432

Earlier quoted context omitted.

But this is assuming that the server has more agency than it does. Servers don't have minds and they don't make authorization decisions. This is more like someone giving you key to a filing cabinet in order to retrieve some documents and while you're there you snoop on the ones next to yours. Is this system more trusting of people than it should be? Probably. Does that mean you're allowed to snoop on other people's d…

But this is assuming that the server has more agency than it does. No, it merely assumes the server is acting on authority of the organization identified by the domain name. It doesn't assume agency, only representation.

Which also seems nuts. Like they’re servers. How anyone assumes that some Ruby code can be acting as an authoritative representative of the government is silly.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#628

Post by Spivak »

zentiggr wrote: post #522
Spivak wrote: post #414

Earlier quoted context omitted.

I very much want the blame to be on the person who broke into my house regardless of whether my door was locked or my window was open.

Which works great when there's some kind of access restriction in place. If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else. That's the proper analogy for what happened in the original article.

This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff.

Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#629

Post by therockspush »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Good one.

A friend of mine bought a book online, that was just a link to a pdf in an S3 url.

I chopped off the /book.pdf part, and it was just in an S3 bucket with all the other books they sell.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#630

Post by [deleted] »

jameshart wrote: post #512
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…

[deleted]
Post reply on HN