Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusting clients is probably a security flaw

liberda.nl

Post reply on HN
Print view View original

51–60 of 150 posts

Re: Trusting clients is probably a security flaw

#51

Post by jddj »

nslqnd wrote: post #49
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.

> the worst that can happen

To you, you mean, right?

Re: Trusting clients is probably a security flaw

#52

Post by chefandy »

jddj wrote: post #51
nslqnd wrote: post #49

Earlier quoted context omitted.

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.

> the worst that can happen To you, you mean, right?

That goes without saying in the software business today. I was in software for decades and I’ve never seen it so cynical. Shameless profiteering seems to be the gold standard strategy. It’s like Gordon Gecko style greed.

Re: Trusting clients is probably a security flaw

#53

Post by gunian »

jddj wrote: post #51
nslqnd wrote: post #49

Earlier quoted context omitted.

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.

> the worst that can happen To you, you mean, right?

Actually interested in learning more about the attack surface area?

I've had my SSN stolen learned multiple people are using it lol so I doubt banking info stolen from Mickey Dees would make a difference could something worse be achieved

Re: Trusting clients is probably a security flaw

#54

Post by gunian »

chefandy wrote: post #52
jddj wrote: post #51

Earlier quoted context omitted.

> the worst that can happen To you, you mean, right?

That goes without saying in the software business today. I was in software for decades and I’ve never seen it so cynical. Shameless profiteering seems to be the gold standard strategy. It’s like Gordon Gecko style greed.

That's cause there are people that make the mean girls from mean girls look like the nice girls

Infighting, KPIs, comp packages, weird ass games trying to build something new or try to learn is actually looked down upon. Very medieval with hunt vibes

Re: Trusting clients is probably a security flaw

#55

Post by xbmcuser »

robertlagrant wrote: post #28
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

Is it not the same for computers most of the apps data is accessible by all the apps. Mobile OS came from the paradigm of the past and as the way we use our phones change so do the way how mobile os work. For a long time Android devs have wanted to obfuscate the disk from the user like iOS does but have faced push back from users and developers so in the end they created a permission where an app needs to ask permission to access the disk. Keeping the file system a black box or allowing user/apps to mess with it is a development question of the times dumb it down or not. Then people here complain children don't know anything about computers these days well yeah because we have dumbed it down so much in the name of security and usablity.

Re: Trusting clients is probably a security flaw

#56

Post by gunian »

graemep wrote: post #6
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

Kind of ironic since you can't easily export data as an end user without some friction

Re: Trusting clients is probably a security flaw

#57

Post by gunian »

Over2Chars wrote: post #33

Hilariously well written. "But the problem with checking if the user is a god, is that the user is a god. They can just tell you what you want to hear." NISUS: Good. Out of the door. Line on the left. One cross each. Next. Crucifixion? MR. CHEEKY: Ah, no. Freedom. JAILER: Hmm? NISUS: What? MR. CHEEKY: Eh, freedom for me. They said I hadn't done anything, so I could go free and live on an island somewhere. NISUS: Oh.…

As they say in the US "we the people have decreed freedom ain't free" had a headache reading this lmao

If you can get a hot meal for 5 dollars idk as a poor person gotta rep the app even if its badly implemented

Re: Trusting clients is probably a security flaw

#59

Post by lou1306 »

nslqnd wrote: post #49
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.

Can't the client sue for damage though? Especially in a courtroom-happy country like the US, perhaps causing financial trouble to a corporation the size of McDonald's would not exactly lead to a happy, carefree livelihood

Re: Trusting clients is probably a security flaw

#60

Post by palata »

master-lincoln wrote: post #12
nonrandomstring wrote: post #8

Ick. That turned my stomach. Sure it's bad for end users that corporate mobile app development is a swamp. In this case it only affects the vendor who lost out on users and reputation. But cavalier, reckless engineering equally causes harm to the client device or end user - if only in wasted time. Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk.…

Why would you want to continue working at such a place as a developer? It's not like it's hard to find another job as developer...

This is assuming that the developers who did that knew that it was bad and still chose to do it.

What if they didn't know and it's just incompetence?

Post reply on HN