Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Fiverr left customer files public and searchable

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 252 posts

Re: Tell HN: Fiverr left customer files public and searchable

#221

Post by walletdrainer »

weird-eye-issue wrote: post #66
walletdrainer wrote: post #18

[flagged]

It's exactly how it works, pages don't just magically appear in Google's index. You need links to pages either from your own website or backlinks from other websites. Alternatively if the page is in your sitemap then Google will typically pick it up or you can manually submit it for indexing. For important pages you would typically want internal links, backlinks, and have it in your sitemap.

Google indexes links from places other than fiverr, odds are these links are mostly from places like GitHub.

Re: Tell HN: Fiverr left customer files public and searchable

#222

Post by ChrisMarshallNY »

xtrial972 wrote: post #218
viaredux wrote: post #209

Update: Fiverr denies allegations of a cybersecurity incident on X. “To be clear, this is not a cyber incident. Fiverr does not proactively expose users’ private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer’s consent before it can be uplo…

this is because you copied the link with the token, token is generated for your logged in user. strip the token and it wouldn't work. other users does not have your token.

You send the bearer token as a GET argument?

I’m sure there’s a good reason for that. I do it, in a server that I publish for general use, but won’t do it, for the server that I control, as I make sure that it reads headers.

Some PHP servers ignore auth headers (and, I suspect, other APIs), so you need to set general-purpose frameworks and servers to use GET arguments, but that’s a security issue, for exactly the reason you state. Too easy to leak logins. If you use headers, then copy and pasting URLs won’t leak logins.

In any case, the token should be timed, but that’s a fairly weak precaution.

Re: Tell HN: Fiverr left customer files public and searchable

#223

Post by morpheuskafka »

evmaki wrote: post #70

Extremely bad stuff here. Can't believe it's been 7 hours now and you can still pull up people's complete prepared tax returns right from a Google search. This should be a business-ending breach of trust and good practices, but I worry there's probably a lack of regulatory might or will to make anything happen.

The company put out its first statement:

> “Fiverr does not proactively expose users’ private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer’s explicit consent before it can be uploaded. As always, any request to remove content is handled promptly by our team."

https://sqmagazine.co.uk/fiverr-security-flaw-private-docume...

It sounds like they are trying to claim the users involved published the links and that's why they are on Google? But how could anyone believe that multiple users intentionally published their SSN?

Re the takedown, I'm also guessing it's from Cloudinary. Maybe HTTP Referrer based?

Re: Tell HN: Fiverr left customer files public and searchable

#224

Post by oefrha »

ndsipa_pomu wrote: post #219
oefrha wrote: post #188

Earlier quoted context omitted.

Some crazy lawyer included my parents in a traffic death suit’s defendants while they were victims who had their car badly damaged when the reckless driver rammed into two cars (including my parents’) and two pedestrians. The question isn’t whether you’re at fault, it’s whether you want to risk getting a court summons.

I'm confused about what you're saying - are you saying that your parents risked getting a court summons though they weren't at fault? Surely the entire point of the court system is to determine who, if anyone, is at fault.

They didn't get a court summons but the court did call and send the plaintiff's filing. They were clearly not in the wrong in that case but it was still a hassle and quite a confusion. The point is people can sue you even if it's BS and you still need to respond.

In this case leaving a paper trail of having accessed unauthorized confidential information looks a lot like being in the wrong, so the potential hassle is a lot higher. You can argue it's not unauthorized after all, and you'll likely win, but you may need to expand time and energy arguing in the first place. And it could be significant.

Edit: In addition, (a) accidentally opening a confidential document -> oops, close immediately; and (b) taking a screenshot could be different legally (NAL yada yada), doing the latter could make it a lot harder to defend yourself.

Re: Tell HN: Fiverr left customer files public and searchable

#225

Post by efreak »

ndsipa_pomu wrote: post #219
oefrha wrote: post #188

Earlier quoted context omitted.

Some crazy lawyer included my parents in a traffic death suit’s defendants while they were victims who had their car badly damaged when the reckless driver rammed into two cars (including my parents’) and two pedestrians. The question isn’t whether you’re at fault, it’s whether you want to risk getting a court summons.

I'm confused about what you're saying - are you saying that your parents risked getting a court summons though they weren't at fault? Surely the entire point of the court system is to determine who, if anyone, is at fault.

Determining who is at fault involves extreme annoyance and inconvenience for those who had fingers pointed at them, regardless of whether or not they were actually involved. If you involve yourself willingly, you're inviting that on yourself.

Re: Tell HN: Fiverr left customer files public and searchable

#226

Post by janoelze »

morpheuskafka wrote: post #223
evmaki wrote: post #70

Extremely bad stuff here. Can't believe it's been 7 hours now and you can still pull up people's complete prepared tax returns right from a Google search. This should be a business-ending breach of trust and good practices, but I worry there's probably a lack of regulatory might or will to make anything happen.

The company put out its first statement: > “Fiverr does not proactively expose users’ private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer’s explicit consent before it can be uploaded. As always, any request to remove content is handled p…

The DMCA takedown also suggests at least one user was not aware of that file being public. This all comes down to what that "sharing" action specifically looked like.

ChatGPT recently had a similar case with the sharing feature on conversations leading to publicly indexed convos. That incident would have also matched the implied definition of sharing here.

Re: Tell HN: Fiverr left customer files public and searchable

#227

Post by morpheuskafka »

pesus wrote: post #46

Wow, the other comments weren't exaggerating. This is really bad. If my tax returns or other data were part of this, I might consider legal action. I wonder if somewhere like Wired/Ars Technica/404media might pick this up?

Company is now telling media this is intended behavior and users knew these files were public / shared the URLs themselves. We need to get some media with wider scope to challenge that.

Re: Tell HN: Fiverr left customer files public and searchable

#228

Post by janoelze »

morpheuskafka wrote: post #227
pesus wrote: post #46

Wow, the other comments weren't exaggerating. This is really bad. If my tax returns or other data were part of this, I might consider legal action. I wonder if somewhere like Wired/Ars Technica/404media might pick this up?

Company is now telling media this is intended behavior and users knew these files were public / shared the URLs themselves. We need to get some media with wider scope to challenge that.

And additionally a failure to handle a responsible disclosure.

Re: Tell HN: Fiverr left customer files public and searchable

#229

Post by morpheuskafka »

walletdrainer wrote: post #212
starkrights wrote: post #206

Earlier quoted context omitted.

Can you actually explain why the phrase you cited from OP is wrong? You say that ~”files need to be linked to from somewhere” is correct. How is a file linked to from somewhere [on the internet] if it’s not being served on the internet that Google crawls (ie, HTML)? The only alternative is in… API calls? That Google probably isn’t crawling? “Fiverr might be hosting public HTML somewhere” seems like an entirely reason…

It’s a huge mistake to assume these links have to originate from fiverr-hosted HTML, it’s far more likely Google is finding them from places like GitHub repos used by fiverr-users.

That was my first thought, but is it logical to assume that 5+ unrelated people took their finished tax return URL and linked it on a website/tweet/etc? Who would do that?

Even still, Fiverr could very well have GDPR/CCPA/etc liability as the host of these files, because they related to its services, it's not just a generic file host.

Re: Tell HN: Fiverr left customer files public and searchable

#230

Post by ryandrake »

Aurornis wrote: post #74
applfanboysbgon wrote: post #65

Earlier quoted context omitted.

This is the result of somebody who has no idea how the fuck the tech they're using works. They surely knew it should be private, but they did not know that they were making it publicly available because they were blindly fumbling their way around in a job beyond their competence level. There is a 0% chance this was ordinary carelessness, in the form of "I know better but don't care enough", this is so clearly a case…

Any time someone tries to suggest certification as a solution I ask the same question: How would it have solved this problem? Would the certification require someone to take an official certification test for the framework used? And therefore we’re only allowed to use frameworks which have certification tests available? If you want to write some new software, do you have to generate a certification for it and get tha…

The certification obviously would have to have teeth. A certification that you needed in order to do work as a software professional, which could be revoked for cases of carelessness or negligence, would disincentivize carelessness and negligence.

This is how airline pilot certificates work. And in that career, certification actually works. It's not a miracle or unexplainable.

Post reply on HN