Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iViewed your API keys

wale.id.au

Post reply on HN
Print view View original

101–110 of 116 posts

Re: iViewed your API keys

#101

Post by akdor1154 »

alias_neo wrote: post #10
raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

The step they seem to be missing is _the entire development process_. If you're using API keys to access stuff, you do it on your backend, there's no excuse for that stuff to make it to the frontend. If your "client" needs access to sensitive API keys, you need to rethink your architecture. As a (senior) backend software engineer, this reeks of a person/team who doesn't know how to architect and/or implement web appl…

Being generous, it might also be a fuckup in implementing SSR... maybe. Still a fuckup though.

Re: iViewed your API keys

#102

Post by cormacrelf »

hiisukun wrote: post #95

Broader context: iView (from the ABC in Australia, a publicly funded broadcaster) was pretty much first to market here for streaming TV, and view on demand. The other stations have all since caught up, but ABC have a tremendous amount of quality children's content so it's a very popular service with families. However, the current government is not a fan of funding the ABC and as such they've been operating with a ver…

Great summary. One last recent detail relevant to HN is that despite being a public broadcaster, they've recently started forcing everyone to make an account to watch things, in order to track viewers more closely & get better data. The BBC also does this, I think, not sure when they started. It's a good question -- should you have a right to view content from the public broadcaster without making an account?

Re: iViewed your API keys

#103

Post by cormacrelf »

asojfdowgh wrote: post #68
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Any sources to these claims, other than "it feels that way so it is"?

It's true in terms of Bernard Collaery / Witness K, but this is not the same at all. The entity being "hacked" is the ABC, which is an independent broadcaster that the government of the day is constantly trying to claim is biased against it. There is no reason to think that the CDPP or the Attorney General would try to defend the ABC from something like this. If anything they would point and laugh, and use it to justify another huge budget cut.

In terms of responding to criticism in the digital realm, you can get a pretty illustrative view of the situation by looking at how the Digital Transformation Office handled feedback to its pile of steaming shit of a coronavirus proximity alert app. Numerous researchers found serious flaws constantly from its first release. It took like 6 months for them to even recognise that any outside researchers had even been helpful, IIRC. Release notes were like "fixed bugs" and then the researchers decompile the .JAR again and say "nope, you absolutely did not fix this huge problem" and then find another one. Meanwhile the government sank millions more dollars into BCG consulting to review it, while these people were working for free and getting no credit. I think their campaign to cast doubt on the app's safety, efficacy and security was successful, and it did not get taken up, and then the report that was due to be published about the project was never released, and it was all swept under the rug. Overall I think it was about $10 million spent for in the vicinity of 5 covid cases identified, I don't remember exactly but I think all of them were also identified by phone interviews.

They did not, however, prosecute the researchers. So, ignorant and unkind, but mostly not like that journalist in the US who enraged a governor to the point of being criminally investigated for opening a webpage.

Re: iViewed your API keys

#104

Post by legalcorrection »

getcrunk wrote: post #99
legalcorrection wrote: post #69

Earlier quoted context omitted.

weev didn’t just “browse a public url at AT&T”. That is dishonestly reductionist. He noticed the bug and then used it to retrieve and make public the private data of over a hundred thousand people.

You are equivocating. Iirc this bug you refer too WAS the public urls

So? You access a few accounts that way, realize you're accessing people's private info, and then stop. No one is gonna charge you for that. Write a script and download a hundred thousand people's private data, that's a whole different thing.

Re: iViewed your API keys

#105

Post by spellsaidwrong »

nojs wrote: post #37

*.id.au is an interesting domain that I haven’t seen before. Apparently you can get an id.au iff you’re an Australian citizen, and it must approximately match your real name.

It's a 2ld for individuals, much like .com.au is a 2ld for companies. In this case, it's not actually supposed to match your real name, but nicknames are allowed.

Re: iViewed your API keys

#106

Post by callalex »

AdamJacobMuller wrote: post #63
cortesoft wrote: post #50

Earlier quoted context omitted.

How do you know it wasn’t rate limited?

for((i=0;i https://site.com/info.php?id=$i > $i.json done

This is a tangent, but curl has built-in support for “globbing”. For numeric ranges you can just put the range in [brackets] and it handles the rest.

Re: iViewed your API keys

#107

Post by KyeRussell »

dylan604 wrote: post #52
mardifoufs wrote: post #48

Earlier quoted context omitted.

But why is the Australian government so "police state" minded? Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the rece…

Seeing as Australia was used as a prison colony, I'd have thought they'd be much more likely to be against a strong ruling class.

Yeah, because a country with over 100 years of post-invasion history would base its worldview purely on the one fact most Americans know about it.

Re: iViewed your API keys

#108

Post by KyeRussell »

sodality2 wrote: post #92
throwaway744678 wrote: post #89

Earlier quoted context omitted.

A friend or a nice neighbor: why not. But a random stranger? I'd certainly be unhappy! Why would they even try to open the door in the first place?

Better one who would let me know, than someone who would steal everything and sell it, no?

Sure, but that doesn’t mean that I’d be thanking you.

These arguments about computer crime law are always the same, and people with your view always shoot themselves in the foot with analogies like this. This is not a pre-existing social expectation. If someone comes to my front door, tells me that it’s unlocked, and tells me that they were trying peoples front doors for the intellectual thrill, there is a 0% chance that I’m an reacting positively. I challenge you to find any material proportion of well-adjusted non-nerds that don’t agree with me.

Re: iViewed your API keys

#109

Post by ehnto »

saimiam wrote: post #77
ehnto wrote: post #74

The Algolia side is required and expected, no? I know you can hide said details to be even safer, but it's expected to have the API public tokens available to the client so they can use the API from your site. The keys shouldn't work on other sites since the API will whitelist your application URL, so stealing them is pointless.

wouldn't `curl -H 'api key' -H'origin:whitelist-url'` let you use Algolia as if you were ABC if all Algolia does is URL whitelisting?

You could, but I suspect it's not a issue in practice else Algolia wouldn't keep working this way. Nor would Google APIs etc.

Re: iViewed your API keys

#110

Post by andrewstuart »

The ABC is underfunded and under attack from the government.

Even if they do have software issues I wouldn't be publicly running attacks against them cause it would just give the government more reason to cut their funding more.

Likely the developers at the ABC are doing the best they can with the limited resources they have, and deserve our support rather than doing the Internet mob attack thing.

Post reply on HN