71–80 of 87 posts
Earlier quoted context omitted.
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
I hope you thought about calling it SheetCoin. Please make it. I want row A.
Dibs on Row 13!
I know this is a low value way of saying this, so, apologies up front but: Fucking lol at their bookkeeping and payout system just being a spreadsheet with no other comparison of truth before submission. We're on course for DAOs to rediscover the basic principles of our existing financial system within the decade.
> We offer the hacker a 10% white hat bounty if he/she would return the stolen fund in next 48 hrs.
I just can't, hahaha. You left your car unlocked with the keys on the dashboard. It's on a boat on its way to a 3rd world country with its plates removed and serial numbers ground off. Good luck.
This is a beautiful example of the biggest current problem with DAOs and all (and I do mean ALL) crypto projects which aim to interface with the real world (i.e. all projects not doing with purely abstract stuff like DeFi-like tokens, and closed systems like "metaverses"): THEY CAN'T. They really cannot interface with the Real World, without leaking real-world problems into the "perfect" smart contract-driven crypto…
Earlier quoted context omitted.
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
I hope you thought about calling it SheetCoin. Please make it. I want row A.
TL;dr the owner of the form changed the permissions to be literally wide open.
you reap what you sow.
Earlier quoted context omitted.
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
I hope you thought about calling it SheetCoin. Please make it. I want row A.
Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.
Each time, gmail says that "John" will not be able to see the document and offers to make it readable/editable for anyone with a link. It appears in a modal window that blocks sending the message. I must read carefully the modal window to click the correct button. "John" can see the doc because he has a google account, but I'm sending the message to his yahoo email because it's his preferred email.
Anyway, I only have a draft of a math midterm for next week. If a hundred of thousands of dollars were in the line, I'd be very nervous.
Earlier quoted context omitted.
Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.
So if you created a secret, clandestine, world-readable, anyone-comments, blog post with the slug "http://example.com/correct-horse-battery-staple/" would you really complain when someone brute-force or outright guessed your blog post?
YouTube has "unlisted" videos which are unsearchable and unreachable unless you've been shared a link, but do people freak out when someone stumbles across this shared by others?
Just because a Google Workspaces ID is a long, jumbled-up, base-64 string doesn't mean it is a password or a cryptographically secure secret. It's quite different. It's meant to be well-known by anyone who is intended to have access. The "Anyone with the Link" access simply relies on a circle of friends/colleagues keeping the URL to themselves.
Earlier quoted context omitted.
> granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit How are…
This is about Google docs. In Google docs access control means not just knowing password and username combo, it also means having the device to receive a time limited 2FA code etc. Plus the ability to revoke access. Very much not just obscurity.
So people want to be progressive and use cryptocurrency that is not tied to a government. But when things go wrong they run to the FBI and FTC both run by the government.
People want their eggs and milk privately, but when the shopkeeper steals their money and runs away, they want the police and the courts. That's not really inconsistent.