Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

51–60 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#51

Post by adgar2 »

alyx wrote: post #17
philwelch wrote: post #10

Earlier quoted context omitted.

If it's accessible on the public internet and asks for something as secure as API keys, that is when you should worry about security, not when it's "meant to be picked up by HN".

Fair, but in any case, the ultimate responsibility still lies with the user's judgment. Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).

Exactly. When you go to provide your information to a website, you need to consider "what are all the possible outcomes of this?" We can't use the reputation of the providers of a service as a proxy and thus have zero information about what to expect. Since you almost never have the source code for the website you're giving your information to, using your logic, just never give your data out. Right?

Re: Never Give Your Information To 10 Minute Old Startups

#52

Post by Silhouette »

JoeCortopassi wrote: post #46
Silhouette wrote: post #41

Earlier quoted context omitted.

Sorry, but I think you're being far too kind. A policy of so-called responsible disclosure is a reasonable approach to take when dealing with an established product/service that contains a minor vulnerability, something potentially dangerous but unlikely to be exploited in the immediate future with serious negative effects. In this case, we appear to have a new project run by people who don't know what they're doing,…

Completely agree. Look at his responses to the security issue being brought up in the original thread [1]. This is someone who is clearly playing fast and loose with some frameworks, and people's information, and does not deserve to be given that consideration. In his own responses, he says that he won't email the users ! I can't imagine how upset I would be if this had my information. Access control for something li…

> In his own responses, he says that he won't email the users!

If they're based almost anywhere in the US or EU, they might well have a legal obligation to notify at this point.

(I am not your lawyer, etc.)

Re: Never Give Your Information To 10 Minute Old Startups

#54

Post by djcapelis »

adgar2 wrote: post #47
zacharyvoase wrote: post #21

Earlier quoted context omitted.

'Relatively senior' here means 'ostensibly trusted with important tasks in the past'. Both of the creators of this application (I won't say 'founders of this startup' because that's silly) are ex-WePay.

I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding. I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.

One would hope that even average developers for a payments company would have a better understanding of security than to make mistakes like this...

Re: Never Give Your Information To 10 Minute Old Startups

#55

Post by merijn481 »

merijn481 wrote: post #48

Ryan, your post is NOT an example of responsible disclosure. You could have written your post and posted it AFTER alerting the Ice Box Pro guys and waiting until they had the main issues fixed. Your post would still be a good post. In fact, you seem to weigh the importance of your post getting on HackerNews above the security of the people who tried Ice Box Pro. The creators of Ice Box Pro had good intentions and mes…

Ah, I see you did let them know and the vulnerability was fixed before you posted. Good. I recommend saying such a thing in your post because it helps people like me understand that you are in fact responsible about the disclosure.

Re: Never Give Your Information To 10 Minute Old Startups

#56

Post by adgar2 »

djcapelis wrote: post #54
adgar2 wrote: post #47

Earlier quoted context omitted.

I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding. I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.

One would hope that even average developers for a payments company would have a better understanding of security than to make mistakes like this...

Except you're talking about a payments startup. In startups, engineering talent isn't very important.

Re: Never Give Your Information To 10 Minute Old Startups

#57

Post by Silhouette »

unreal37 wrote: post #50
clockstrikesten wrote: post #45

Earlier quoted context omitted.

You speak of "responsible disclosure", but what about "responsible launch"? If a backend is coded this poorly, it betrays irreparable and highly dangerous levels of idiocy, laziness, and lack of foresight in the ones who coded it. Everyone deserves to be informed of this blunder so they know to avoid this group like the plague. Public ridicule and preemptive destruction of the brand is the only conscionable reaction.

It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News. They probably should have shut it down or disabled registrations once it got out until it was tested.

> It sounds like it wasn't launched yet. [...] Someone discovered the URL and posted it to Hacker News.

Sorry, but if you put a public site on the Internet, somewhere it can be discovered, and you are prompting people to put in sensitive credentials on that site, then you have launched for practical purposes. You should be implementing security measures accordingly.

If you're not ready for that and just want to show friends, it's not exactly rocket science to add basic HTTP Auth to the site, lock it to specific IP addresses, or any number of other trivial measures that would have prevented this problem.

Re: Never Give Your Information To 10 Minute Old Startups

#58

Post by larrys »

LnxPrgr3 wrote: post #44
patio11 wrote: post #27

Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure." This incentivizes people to fix things quickly and preserves the reputational value of break…

I'm generally with you, but I do hope that this tarring and feathering will drive home one point: Don't trust the client. The user ID in the URL like this is a giant "try editing me and see what happens" sign, even if you came with no intention of providing unsolicited pen testing. I seriously doubt just this one person noticed.

"The user ID in the URL like this is a giant "try editing me and see what happens" sign"

What's really surprising is that apparently the dev on this never viewed any porn on the internet.

Post reply on HN