Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flickr: Invitations disclosure (resend feature)

hackerone.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Flickr: Invitations disclosure (resend feature)

#11

Post by ars »

dlss wrote: post #7
andenq wrote: post #3

Well thats messed up... At least now I know how spammers get my email :D

As jpalomaki points out it's better than that... We are entering a brave new world of spam that's "from" people you know.

No, we've been there for a long long time now.

I use different email address for different people, and virtually every single one of them has been harvested and used to send spam from that person.

At this point I don't expect email to be secure at all. You basically have to expect that unless you are dealing with someone with IT skills their email will inevitably get hacked.

The implication is that email is NOT a good way of doing password resets. The problem is what's the alternative (that doesn't require specialized hardware, like a 2nd auth token generator)?

Re: Flickr: Invitations disclosure (resend feature)

#12

Post by Sovietaced »

crucio wrote: post #10
jpalomaki wrote: post #2

A simple fix seems to be to use longer random id for the invitation. As d4d1a179c0f3 mentions, this kind of information could be useful for setting up more targeted phishing attacks. "Hi John, remember the Flickr invite for holiday photos I sent you two weeks ago? I moved my albums to new site, please go to blackhat.org/malwaredl.."

Yeah it would be a fairly simple fix in code: they could hash some of the user data (e.g. email + name) and then append the id to create a token that won't ever collide and is always unique. e.g. - " rel="nofollow">http://www.flickr.com/invite/?resend= -

Exactly what I was thinking, expiration isn't even necessary.

Re: Flickr: Invitations disclosure (resend feature)

#13

Post by mantrax4 »

Schofield, you're fired!

Maybe the incentives are wrong. Less bugs, less work for the dev.

Maybe the people processing bug submissions should be paid more per bug submitted and should not be on the same team as the developers.

But there's ocean of incompetence out there, and clever processes can only get you so far when you're dealing with incompetence.

Re: Flickr: Invitations disclosure (resend feature)

#14

Post by diziet »

abalone wrote: post #5

I love how publicly posting bugs shifts the balance of power. "schofield" probably though it was just a conversation between Yahoo and the submitter. Now it's a conversation between Yahoo and Hacker News. Welp, the verdict is schofield is being dense. Of course user relationship pairs are potentially sensitive. Therefore enabling attackers to discover them by enumerating your tiny key space is an issue. Either schofi…

To be fair the 'schofield' has been diligent before: https://www.google.com/search?q=site:hackerone.com+schofield

Are the relationship pairs actually being exposed? All I can see are the email / name pairs - not who invited the user (and you have to be logged into a Yahoo account).

Re: Flickr: Invitations disclosure (resend feature)

#15

Post by newaccountfool »

andenq wrote: post #3

Well thats messed up... At least now I know how spammers get my email :D

Glad to see people still see spam as a problem, a few days ago when there was an article about Twitter Spam people where making it out like Email Spam has gone away and that Twitter should implement the same rules.

Re: Flickr: Invitations disclosure (resend feature)

#16

Post by chris_overseas »

So I clicked on one of the example invite links listed in the bug report. I was then prompted to log in to my Yahoo account. Hmm, OK... so I logged in, at which point I was taken to a page with a form asking me to join Flickr. I did NOT fill in or submit the form because I don't want a Flickr account, though it was presented with defaults based on my Yahoo ID anyway. I closed that window and tried clicking on an invite link again. Much to my surprise, the link then worked and I received an email saying "Welcome to Flickr". What the hell?

[edit: on the plus side, Flickr make it very easy to delete your account entirely. The only obvious side effect is that the screen name you had is now unavailable for any further users]

Re: Flickr: Invitations disclosure (resend feature)

#17

Post by jamesbrownuhh »

diziet wrote: post #14
abalone wrote: post #5

I love how publicly posting bugs shifts the balance of power. "schofield" probably though it was just a conversation between Yahoo and the submitter. Now it's a conversation between Yahoo and Hacker News. Welp, the verdict is schofield is being dense. Of course user relationship pairs are potentially sensitive. Therefore enabling attackers to discover them by enumerating your tiny key space is an issue. Either schofi…

To be fair the 'schofield' has been diligent before: https://www.google.com/search?q=site:hackerone.com+schofield Are the relationship pairs actually being exposed? All I can see are the email / name pairs - not who invited the user (and you have to be logged into a Yahoo account).

Leaking someone's email address and associated name is bad enough. If Yahoo don't see that as sensitive it places the ability of miscreants to entirely own and abuse Yahoo Mail accounts in some kind of institutional context.

Re: Flickr: Invitations disclosure (resend feature)

#18

Post by mcintyre1994 »

ars wrote: post #11
dlss wrote: post #7

Earlier quoted context omitted.

As jpalomaki points out it's better than that... We are entering a brave new world of spam that's "from" people you know.

No, we've been there for a long long time now. I use different email address for different people, and virtually every single one of them has been harvested and used to send spam from that person. At this point I don't expect email to be secure at all. You basically have to expect that unless you are dealing with someone with IT skills their email will inevitably get hacked. The implication is that email is NOT a goo…

You don't need to hack someone's account to send mail as them, you just need a server that will get into the popular services. That's the reason social graphs are sensitive, match up people who trust each other and send them messages as each other.

Interesting point about password resets though, if you can read (have hacked) the email you're into pretty much any account. BTW in case you're unaware any Android/iOS device can run Google authenticator and generate 2FA tokens. Email behind 2FA is probably the best security/friction tradeoff for that sort of message, but not many people use it.

Re: Flickr: Invitations disclosure (resend feature)

#20

Post by nilved »

crucio wrote: post #10
jpalomaki wrote: post #2

A simple fix seems to be to use longer random id for the invitation. As d4d1a179c0f3 mentions, this kind of information could be useful for setting up more targeted phishing attacks. "Hi John, remember the Flickr invite for holiday photos I sent you two weeks ago? I moved my albums to new site, please go to blackhat.org/malwaredl.."

Yeah it would be a fairly simple fix in code: they could hash some of the user data (e.g. email + name) and then append the id to create a token that won't ever collide and is always unique. e.g. - " rel="nofollow">http://www.flickr.com/invite/?resend= -

Or just use a UUID.
Post reply on HN