81–90 of 114 posts
It took THREE YEARS (August 2020 - August 2023) to fix the vulnerability? I'm not sure the size of the Harvest team, but that still seems insane.
I don't understand why this issue was not communicated to Microsoft. They could've just revoked access for this oauth application until the issue was fixed. Although there are probably thousands of similar bad implementations out there that are connected to Microsoft via oauth.
I did not know that was possible! I would never have thought to do that, personally.
I have no idea if Microsoft would react to such a report, and what's the correct channel to submit it. But bug reports or abuse reports they usually take seriously.
Well, this is disconcerting. I've used Harvest and found the support to be absolutely stellar, with prompt responses that clearly and deeply understood the nuances of how customers are using the product and detailed steps on how to creatively use existing features. Anything unimplemented yielded, "we'll put that on the backlog but no promises." Given the 30 headcount cited in engineering [1], I don't know where it go…
Worth quoting here... "...In the process of disclosing and patching this vulnerability, the Harvest team was barely responsive. The company acknowledged the vulnerability by triaging but took a very long time to fix the vulnerability. After 3 years of reporting, the company finally fixed the vulnerability silently and didn't bother to inform...no bounty or even HackerOne points were rewarded by the company..." And fr…
The issue stayed on Triage state and I missed the reporter updates. I talked to the author of the post and I believe we are in good terms now.
The security and privacy of our customers is extremely important to us, everything we say in our security page is true and I've been working on this for years.
RFC 6749 goes into details on how the authorization server should prevent this type of attack The authorization server MUST require public clients and SHOULD require confidential clients to register their redirection URIs. If a redirection URI is provided in the request, the authorization server MUST validate it against the registered value. So how is this possible, when presumably the Harvest app did not register th…
They are adding a second redirect on top and sticking it into the state parameter, presumably so they can redirect to anywhere. so the flow wanted was Go the some harvest authorize url, That redirects to the Microsoft authorize url with redirect_uri=registered_uri and state=some_encoded_final_uri, user enters credentials, redirect to a registered uri read state parameter and redirect to uri encoded in state. This exp…
Hi! I'm the person in charge of managing the bug bounty program, and I'd like to shed light on what happened from our end. I already apologized and explained this to @0xcrypto internally, but I believe that I should say something here to clarify what happened. The truth here is that we were never able to fully reproduce the issue from the beginning, but struggled to close it because of the fear of missing something.…
Great to hear, I love using Harvest. But could you please finally fix the (not so) new mobile app (iOS)? There are so many tiny issues that I stopped reporting them to your support. The app state constantly gets out of sync with server state (some changes on the server only show up after a force reload, some changes on the client just revert after pressing save) And the time tracking UX is so annoying (buttons that a…
Earlier quoted context omitted.
Great to hear, I love using Harvest. But could you please finally fix the (not so) new mobile app (iOS)? There are so many tiny issues that I stopped reporting them to your support. The app state constantly gets out of sync with server state (some changes on the server only show up after a force reload, some changes on the client just revert after pressing save) And the time tracking UX is so annoying (buttons that a…
He manages the big bounty program. Why would you think he would be interested in your personal UX issues with the app?
And I would doubt that those are my "personal" UX issues.
Earlier quoted context omitted.
He manages the big bounty program. Why would you think he would be interested in your personal UX issues with the app?
I think you have a wrong impression of the size of the company. According to their website they have 26 engineers in total. And I would doubt that those are my "personal" UX issues.
Earlier quoted context omitted.
He manages the big bounty program. Why would you think he would be interested in your personal UX issues with the app?
I think you have a wrong impression of the size of the company. According to their website they have 26 engineers in total. And I would doubt that those are my "personal" UX issues.
Apparently Harvest is it's own company, not owned or operated by MS.
Well, this is disconcerting. I've used Harvest and found the support to be absolutely stellar, with prompt responses that clearly and deeply understood the nuances of how customers are using the product and detailed steps on how to creatively use existing features. Anything unimplemented yielded, "we'll put that on the backlog but no promises." Given the 30 headcount cited in engineering [1], I don't know where it go…