Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking the email of any YouTube user for $10k

brutecat.com

Post reply on HN
Print view View original

91–100 of 487 posts

Re: Leaking the email of any YouTube user for $10k

#91

Post by iinnPP »

pcthrowaway wrote: post #52
sd9 wrote: post #29

Earlier quoted context omitted.

MM/DD/YY is an exclusively American standard https://en.wikipedia.org/wiki/List_of_date_formats_by_countr... I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.

Canada uses this also, though we also use day-month-year and year-month-day. Yes, this effectively makes dates nearly impossible to decipher here.

I have always dated things with months spelled for this reason. Except where the format is clearly defined, which is fairly common and likely for the same reason.

Re: Leaking the email of any YouTube user for $10k

#92

Post by tgsovlerkhgsel »

michpoch wrote: post #2

Am I very naive expecting the payout to be significantly higher?

Yes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd actually consider that a surprisingly high amount, and I would expect that many companies wouldn't consider this class of bug a bounty-worthy issue at all - "thanks for the report", maybe fix it maybe not, but no bounty.

Re: Leaking the email of any YouTube user for $10k

#94

Post by TheDong »

zwnow wrote: post #88
TheDong wrote: post #70

Earlier quoted context omitted.

I'd take away "security is complicated and multi-faceted", not "fake". It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess". Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the a…

Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security. I am not talking about the app itself. You can have all the security implemented the world has to offer and yet you cant get rid of human errors.

I'm totally not understanding what you're saying then.

> Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security

Pretend I'm a signal employee. What link can I click that breaches the app's security?

They don't store unencrypted data, pushing source code changes requires review, releases are signed and a single employee can't compromise the release process, so I'm missing how one employee being compromised could lead to the signal app breaching signal's security.

Also, in practice, how often are apps compromised from a phishing attack? I don't even really see news reports on that, so I'm curious if you're operating off like a specific case or something.

Re: Leaking the email of any YouTube user for $10k

#95

Post by asah »

tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

Also, Google can monitor the grey/black market and buy these exploits under false identities. For less urgent vulnerabilities (such as the YT email hack), this severely caps the bounty size.

Re: Leaking the email of any YouTube user for $10k

#96

Post by zwnow »

TheDong wrote: post #94
zwnow wrote: post #88

Earlier quoted context omitted.

Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security. I am not talking about the app itself. You can have all the security implemented the world has to offer and yet you cant get rid of human errors.

I'm totally not understanding what you're saying then. > Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security Pretend I'm a signal employee. What link can I click that breaches the app's security? They don't store unencrypted data, pushing source code changes requires review, releases are signed and a single employee can't compromise the release process, so I'm mis…

Some malicious mail that grants remote access to the employees device? Its not that hard to understand.

Re: Leaking the email of any YouTube user for $10k

#97

Post by mmsc »

tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

>Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no.

Absolutely, yes. Spam and targeted phishing attacks are in high demand.

My understanding is that it is possible to retrieve every public youtube channel ID, if not also Google Maps/Play reviewers, quite easily. This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created.

Re: Leaking the email of any YouTube user for $10k

#98

Post by CSMastermind »

hkwerf wrote: post #23
nullderef wrote: post #4

Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.

You're essentially suggesting a Drake equation [1] equivalent for the number of security vulnerabilities based on NLoC. What other factors would be part of this equation? [1] https://en.wikipedia.org/wiki/Drake_equation

Language or framework definitely plays a role (isn't that what the Rust people are so excited about). Maybe say like the materials/tools used.

There's definitely some measure of complexity. I still like simple cyclomatic but I know there are better ones out there that try to capture the cognitive load of understanding the code.

The attack surface of the system is definitely important. The more ways that more people have to interface with the code, the more likely it is that there will be a mistake.

Security practices need to be captured in some way (maybe a factor that gets applied). If you have vulnerability scanning enabled that's going to catch some percentage of bugs. So will static analysis, code reviews, etc.

Re: Leaking the email of any YouTube user for $10k

#99

Post by tialaramex »

vladms wrote: post #87
nullderef wrote: post #4

Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.

I would challenge you to give me examples where security feels "real" and how does that help. Most software products rely on very complex software stacks, and if you trust 100% all the libraries and the OS you use I would say it's a wrong mindset. There were bugs even in the processor (meltdown). Security is a continuous battle and you never know if you won, only (sometimes) if you loose.

You can tell security is real the same way as lots of other things, reality doesn't give a fuck. Like how you can tell the difference between man's laws (e.g. "The Offside Rule" or "Constitutional Rights") and Mother Nature's laws (e.g. Thermodynamics). Try it, kick the ball even though the rule says you mustn't - if you get lucky the referee doesn't notice and play continues. But if you try to make a system more ordered without expending energy it does not work. Reality doesn't give a fuck.

When I breeze through your login process with the wrong credentials that's because your security was fake, if it was real that would break because it didn't know who I was, so if some bug lets me past login I don't somehow successfully log in as me, I'm logging in as nobody at all which is clearly nonsense.

This is "Make Invalid States Unrepresentable" at scale, and it's difficult to do, but not impossible.

Re: Leaking the email of any YouTube user for $10k

#100

Post by xyst »

55555 wrote: post #6

This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.

A database of every YT user then x-referencing them with public services (fb/ig/twitter). Build shadow profiles, sell db to highest bidder.

Or just plain ole pwning them. Most users still tend to use the same password across different services, not use 2FA, and involved in at least 1 high profile leak (I know I’m in at least a dozen so far per haveibeenpwned).

Occasionally you get the victim that uses that same password for their e-mail service and that can allow you to bypass e-mail 2FA if enabled. Even better if the account is used for social SSO (ie, Google, Facebook, Twitter). Then you have access to a treasure trove of services; or just delete them for lulz

Post reply on HN