Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

171–180 of 266 posts

Re: I found Prezi's source code

#171

Post by vertis »

infosec_au wrote: post #150
darkbot wrote: post #76

This is definitely out of the scope of their "bughunt", although I think the guy should be rewarded anyway. But I'm also quite upset with the fact that OP is outing the dev. Everybody makes mistakes, no need to out any individual developer because OP is pissed at the company management.

I realised 2-3 hours after my blog post, and rushed to redact the last names from the post + pdf. I have now also redacted last names from the screenshots. Sorry about that! But thank you for letting me know. :)

FYI, You can still see the url of the user on bitbucket and from there still get a name.

Re: I found Prezi's source code

#172

Post by mendicantB »

ars_technician wrote: post #168
mendicantB wrote: post #157

Earlier quoted context omitted.

To be frank, this isn't some minor display bug, he had access your source. In other words, this could have ended your company . He could have sold or leaked it. If naivety is stopping you from grasping the possible consequences, then go ahead and read about Adobe's recent mishap. You should be on your knees worshipping him.

Leaked source code does not end a company. Tone back the melodrama. A legitimate company cannot use stolen code like that, and prezi isn't the type of service with ground breaking algorithms to copy into other code.

Sure, in that possibility, that is very true in that nobody could build a full fledged knockoff product. But, what concepts or features that could result in cheap knockoffs? Designed attacks? Password leaks and user privacy breaches? Customer information that can be sold to competitors? All of the bad PR and loss of business as a result?

Re: I found Prezi's source code

#173

Post by octatone2 »

sophacles wrote: post #128
Ensorceled wrote: post #123

Earlier quoted context omitted.

I think he meant scan the source code for security issues and then report those bugs one by one ...

That is what I meant, I should have been more clear.

It was perfectly clear, I don't know what the parent is on about with blackmail.

Re: I found Prezi's source code

#175

Post by tantalor »

ars_technician wrote: post #167
tantalor wrote: post #81

Earlier quoted context omitted.

> Does spear phishing employees email accounts and using their password to access control panels count as a bug? Yes, because those control panels should require 2FA, so password-only access is a bug.

2FA is susceptible to spear phishing if all the attacker needs is a one time login. Remember that credentials and tokens can be relayed.

Not necessarily. FIDO fixes this.

http://www.fidoalliance.org/user-experience.html

Re: I found Prezi's source code

#176

Post by RyanZAG »

dllthomas wrote: post #165
RyanZAG wrote: post #155

Earlier quoted context omitted.

I disagree here - you've either lost the data or you haven't. You can make guesses as to the expected resources of the attacker, but if you're wrong and the attacker has more resources, then you might as well have not even bothered. As an example, you have some fairly non-sensitive private health records. Here are three approaches: (1) No security at all. You hope nobody is going to bother taking them and using them…

"Because they tried" doesn't get a B. You're not graded on effort. What you're graded on - when it comes to defense as opposed to recovery, though both are a part of this - is how likely a breach is. Unfortunately, you don't always learn your grade (and when you do, it's bad). "Gambling with security will always be a losing bet in the long run. Rather just make it secure. Going off some strange 'expected resources' i…

No. But if the site gets hacked, I failed. If I asked users for their credits cards and stored it in a publicly accessible plain text file or in a secure system that still gets hacked the end result is still the same. My users are having unauthorized payments coming off their credit cards. I've failed.

Maybe I can sleep better at night if I didn't go storing them in plain text and I can make up excuses easier, but I still failed. Regardless of how likely any breach was, I failed. My customers have probably jumped ship.

If I store it in plain text and I never get hacked, then I've succeeded. I'm more likely to succeed the more security I add, but if it gets stolen then it doesn't matter anymore. Basically I'm trying to imply that success or failure is a boolean based on real world results and does not depend on the amount of effort placed into the security. The security can influence the result, but once the result occurs the security I used or did not use is irrelevant.

So skimping on security is always a terrible idea. If you know of a way to increase security, then you should increase it. If you offer a bug bounty to improve security, make sure you give a reward for any possible breach that could cause you to get hacked, regardless of whose 'fault' the vulnerability is. If someone can social engineer your developer, then pay out the bounty. Maybe it won't happen next time because now the developer has learned something.

Re: I found Prezi's source code

#179

Post by lifeisstillgood »

RyanZAG wrote: post #176
dllthomas wrote: post #165

Earlier quoted context omitted.

"Because they tried" doesn't get a B. You're not graded on effort. What you're graded on - when it comes to defense as opposed to recovery, though both are a part of this - is how likely a breach is. Unfortunately, you don't always learn your grade (and when you do, it's bad). "Gambling with security will always be a losing bet in the long run. Rather just make it secure. Going off some strange 'expected resources' i…

No. But if the site gets hacked, I failed. If I asked users for their credits cards and stored it in a publicly accessible plain text file or in a secure system that still gets hacked the end result is still the same. My users are having unauthorized payments coming off their credit cards. I've failed. Maybe I can sleep better at night if I didn't go storing them in plain text and I can make up excuses easier, but I…

This is a fascinating discussion because it betrays two fundamental attitudes of society to risk.

RyanZAG is "correct". If someone breaks into my house and steals my TV, then my security was a failure.

This leads to the next problem - its not a catastrophic failure in today's (western) society. I am probably out at work, and I am insured, and the burglar is unlikely to be waiting when I get home to murder me.

However, there have been plenty of societies in the past, and are many now, where the expectation of loss would be almost total - someone breaches your security, they take the tv, kill you and your family and burn the house down on the way out.

So its not a judgement on the resources of the attacker that matters, it is the expected consequences of the breach - the expected value of damage.

Which side of the argument you come down on depends on whether you see the Internet as basically a nice London suburb with a few bad eggs in it, or a violent amalgam of Feudal Middle England and Mogadishu on a bad day.

Re: I found Prezi's source code

#180

Post by dllthomas »

RyanZAG wrote: post #176
dllthomas wrote: post #165

Earlier quoted context omitted.

"Because they tried" doesn't get a B. You're not graded on effort. What you're graded on - when it comes to defense as opposed to recovery, though both are a part of this - is how likely a breach is. Unfortunately, you don't always learn your grade (and when you do, it's bad). "Gambling with security will always be a losing bet in the long run. Rather just make it secure. Going off some strange 'expected resources' i…

No. But if the site gets hacked, I failed. If I asked users for their credits cards and stored it in a publicly accessible plain text file or in a secure system that still gets hacked the end result is still the same. My users are having unauthorized payments coming off their credit cards. I've failed. Maybe I can sleep better at night if I didn't go storing them in plain text and I can make up excuses easier, but I…

No, security is about trade-offs. If you throw absurd resources toward protecting against entirely unrealistic threats and your company goes out of business, you've failed. If you have legitimately made the risks small enough, for the resources and threat model (and that threat model sufficiently matches reality), you've succeeded. There are of course some legitimate caveats, including talk of externalities and questions about how one would measure things, but I still assert my basic model is more correct than yours.

Recognition that security is only as strong as the weak link does not imply that all links must be infinitely strong.

Post reply on HN