Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

21–30 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#21

Post by zacharyvoase »

adgar2 wrote: post #12
zacharyvoase wrote: post #11

I took a look at the team. Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this? It looks like this was just the default Rails resource scaffolding.

> Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this? Only if you're concerned that you can't tell who is "relatively senior." In this case, your judgement was unfortunately wrong.

'Relatively senior' here means 'ostensibly trusted with important tasks in the past'. Both of the creators of this application (I won't say 'founders of this startup' because that's silly) are ex-WePay.

Re: Never Give Your Information To 10 Minute Old Startups

#22

Post by Silhouette »

10 minutes? Never give your information to a business that made a mistake like this, ever.

That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I prefer to assume naivety rather than malice.)

Unfortunately, the only sensible action when faced with a business like this is to run away and not look back for a very long time, except perhaps to check who the people responsible were so you can avoid anything else they work on in the near future as well.

Re: Never Give Your Information To 10 Minute Old Startups

#23

Post by ddellacosta »

I'm curious, did you let them know that this vulnerability exists before you wrote an article and posted it to HN?

If you let them know and they ignored you, then I understand that you'd want to write an article and spread it around. It's important that customers know when a company doesn't value their security. At that point, the proper way for them to handle it is to quietly fix it, and then let all their affected customers know so they have a chance to change their security settings.

However, if you didn't give them a bit of time first, then you are doing more damage than good to them--and their customers.

Re: Never Give Your Information To 10 Minute Old Startups

#26

Post by nostrademons »

RKearney wrote: post #19
andrewcooke wrote: post #16

if anyone else is having problems viewing this: it's a serious hole in icebox, the service featured here http://news.ycombinator.com/item?id=4619132 if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched). [i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux…

What OS/Browser are you using?

I'm getting the same. Chrome 22/Mac.

Re: Never Give Your Information To 10 Minute Old Startups

#27

Post by patio11 »

Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure."

This incentivizes people to fix things quickly and preserves the reputational value of breaking into things without researcher-vendor relations getting adversarial when you announce something like "I harvested a couple dozen of your customers' API keys" or "Here's an exploitation roadmap you can follow in your browser" in a public forum.

Re: Never Give Your Information To 10 Minute Old Startups

#29

Post by bmelton »

RKearney wrote: post #19
andrewcooke wrote: post #16

if anyone else is having problems viewing this: it's a serious hole in icebox, the service featured here http://news.ycombinator.com/item?id=4619132 if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched). [i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux…

What OS/Browser are you using?

I have the same problem as the GP, and I'm using Chrome on OSX. Hope it helps.

Re: Never Give Your Information To 10 Minute Old Startups

#30

Post by misiti3780 »

natrius wrote: post #9
citricsquid wrote: post #3

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.

i agree - i cant think of a reason why the user id would ever be in the account url
Post reply on HN