Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I “found” the database of a college app (2018)

yoginth.com

Post reply on HN
Print view View original

21–30 of 107 posts

Re: I “found” the database of a college app (2018)

#21

Post by NKCSS »

gchamonlive wrote: post #13
ggggtez wrote: post #3

Visible key isn't the bug. The bug is that the app should not have read access to other students.

permissions are a pain... i am considering centralizing permission handling in a separate service environment so that every service I have shares the same permission logic. It is a shame since we could save some latency time by having permissions implemented in the same language and app that it is being requested. But to avoid stuff like that in the article I believe the cons are worth it edit: the user had direct ac…

Security and usability are always at the opposite end of the spectrum. Balance it wisely.

Re: I “found” the database of a college app (2018)

#22

Post by bgdam »

kazinator wrote: post #17

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

Here in India, the University I attended requires a minimum attendance of 75%, or they won't allow you to sit the end of semester exams. Your attendance even accounts for 5% of the score of your end of semester exams for that course. Quite insane when you think about it.

Re: I “found” the database of a college app (2018)

#24

Post by saagarjha »

kazinator wrote: post #17

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

I attend a public school in the United States, and attendance is de-facto enforced by questions that you answer during class (using iClickers, or by quizzes you turn in at the end).

Re: I “found” the database of a college app (2018)

#25

Post by hyperthreading »

diericx wrote: post #11
hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info. edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!

> Don’t put your API keys, Tokens and Secrets visible easily

I was just confused at this part because permission & rules are the solution as far as I know. Thanks for the reply though :) I'm prettry sure now that exposing keys are no problem.

Re: I “found” the database of a college app (2018)

#26

Post by AmericanChopper »

NKCSS wrote: post #21
gchamonlive wrote: post #13

Earlier quoted context omitted.

permissions are a pain... i am considering centralizing permission handling in a separate service environment so that every service I have shares the same permission logic. It is a shame since we could save some latency time by having permissions implemented in the same language and app that it is being requested. But to avoid stuff like that in the article I believe the cons are worth it edit: the user had direct ac…

Security and usability are always at the opposite end of the spectrum. Balance it wisely.

This is such a dangerous false dichotomy. Plenty of security systems benefit user experience.

Re: I “found” the database of a college app (2018)

#28

Post by AlphaWeaver »

What makes this even more sloppy for the school is that I know for a fact that Firebase will send your admin account an email when it detects that you have weak security settings on your database. It also sends said email repeatedly, once per day.

I know because I intentionally have a developer db that is read access for the whole world and I get that email every afternoon. The admin of this app either is not competent enough to know what that email means, or is willfully ignoring it.

Re: I “found” the database of a college app (2018)

#30

Post by mattlondon »

AlphaWeaver wrote: post #28

What makes this even more sloppy for the school is that I know for a fact that Firebase will send your admin account an email when it detects that you have weak security settings on your database. It also sends said email repeatedly, once per day. I know because I intentionally have a developer db that is read access for the whole world and I get that email every afternoon. The admin of this app either is not compete…

Or registered on a "throw-away" gmail account created for this app that no one is reading.
Post reply on HN