Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

251–260 of 266 posts

Re: I found Prezi's source code

#251

Post by davorak »

csallen wrote: post #215
davorak wrote: post #71

Earlier quoted context omitted.

Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.

Define "take" source code. Do you mean "read" or "access" source code? I know this is an aside, but I think we as a community need to be more judicious in our use of criminally-accusatory words, especially when it comes to taking/stealing/theft vs copying vs distributing/selling vs reading/watching/accessing. They're all very, very different things.

You read my post in the ~5 secs widow where it had the word "take." It was the wrong word because in the case I was talking about it would not have deprived Prezi access to their source code.

Re: I found Prezi's source code

#252

Post by davorak »

dllthomas wrote: post #99
davorak wrote: post #71

Earlier quoted context omitted.

Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.

As I read it, he didn't use the credentials to take the source code; he found the credentials in the source code. He used the credentials merely to verify the credentials were valid.

Ahh, at the time I thought err4nt was referring to the public posted login credentials and was making the analogy off of that.

Re: I found Prezi's source code

#253

Post by antsar »

foldr wrote: post #243
smtddr wrote: post #225

Earlier quoted context omitted.

I think he means that if we're not holding Prezi ethically responsible to pay the bounty, then we can't then start saying the researcher is ethically bound not to sell the exploit.

But Prezi aren't ethically responsible for paying the bounty. They stated the conditions pretty clearly and what he found wasn't within their scope.

That waives legal responsibility, but I fail to see how it affects ethics/morals. The ethical implications of an action are determined by the community/profession, so if the community agrees that this was unethical, it was.

Re: I found Prezi's source code

#254

Post by ars_technician »

mendicantB wrote: post #172
ars_technician wrote: post #168

Earlier quoted context omitted.

Leaked source code does not end a company. Tone back the melodrama. A legitimate company cannot use stolen code like that, and prezi isn't the type of service with ground breaking algorithms to copy into other code.

Sure, in that possibility, that is very true in that nobody could build a full fledged knockoff product. But, what concepts or features that could result in cheap knockoffs? Designed attacks? Password leaks and user privacy breaches? Customer information that can be sold to competitors? All of the bad PR and loss of business as a result?

>Password leaks and user privacy breaches? Customer information that can be sold to competitors?

Source code does not include that information. Do you know how software works?

Re: I found Prezi's source code

#255

Post by ars_technician »

tantalor wrote: post #175
ars_technician wrote: post #167

Earlier quoted context omitted.

2FA is susceptible to spear phishing if all the attacker needs is a one time login. Remember that credentials and tokens can be relayed.

Not necessarily. FIDO fixes this. http://www.fidoalliance.org/user-experience.html

How? A phishing site can relay any of this information by acting as a client to the real site while prompting the end user for the requested credentials.

The only way FIDO could prevent this would be to make the credentials dependent on the URL in the browser, but I don't see where it does this.

Re: I found Prezi's source code

#256

Post by ars_technician »

hysan wrote: post #220
mendicantB wrote: post #172

Earlier quoted context omitted.

Sure, in that possibility, that is very true in that nobody could build a full fledged knockoff product. But, what concepts or features that could result in cheap knockoffs? Designed attacks? Password leaks and user privacy breaches? Customer information that can be sold to competitors? All of the bad PR and loss of business as a result?

You would also have access to their development branches which would give insight into future product features and bug fixes that have not yet been released. The former would be useful information to give to competitors and really put the company into a tough position to compete down the line while the latter could be used to find possible critical holes to exploit.

> used to find possible critical holes to exploit.

If a competitor did this, they are risking having their entire business shut down for hacking. Seriously, what are you thinking?

Re: I found Prezi's source code

#257

Post by hysan »

ars_technician wrote: post #256
hysan wrote: post #220

Earlier quoted context omitted.

You would also have access to their development branches which would give insight into future product features and bug fixes that have not yet been released. The former would be useful information to give to competitors and really put the company into a tough position to compete down the line while the latter could be used to find possible critical holes to exploit.

> used to find possible critical holes to exploit. If a competitor did this, they are risking having their entire business shut down for hacking. Seriously, what are you thinking?

Who says a competitor has to be the one to exploit security holes? It is much more likely that the source code would be sold on the black market to those who have no qualms about doing this for gain.

Re: I found Prezi's source code

#258

Post by dllthomas »

dasil003 wrote: post #181
RyanZAG wrote: post #176

Earlier quoted context omitted.

No. But if the site gets hacked, I failed. If I asked users for their credits cards and stored it in a publicly accessible plain text file or in a secure system that still gets hacked the end result is still the same. My users are having unauthorized payments coming off their credit cards. I've failed. Maybe I can sleep better at night if I didn't go storing them in plain text and I can make up excuses easier, but I…

You're conflating two things, inappropriately in my opinion: > If you offer a bug bounty to improve security, make sure you give a reward for any possible breach that could cause you to get hacked, regardless of whose 'fault' the vulnerability is. This is true. There's no upside for rejecting this as "out of bounds" except for a relatively tiny sum of cash. > If you know of a way to increase security, then you should…

'This is true. There's no upside for rejecting this as "out of bounds" except for a relatively tiny sum of cash.'

There can be. If the attack involved something that - done broadly - would itself cause problems even without a vulnerability, then you don't want to reward people for probing those ways without arranging it first. As a sort of extreme example, imagine hundreds of security researchers getting in the way of your paying customers while trying social engineering attacks on your staff.

Re: I found Prezi's source code

#259

Post by tantalor »

ars_technician wrote: post #255
tantalor wrote: post #175

Earlier quoted context omitted.

Not necessarily. FIDO fixes this. http://www.fidoalliance.org/user-experience.html

How? A phishing site can relay any of this information by acting as a client to the real site while prompting the end user for the requested credentials. The only way FIDO could prevent this would be to make the credentials dependent on the URL in the browser, but I don't see where it does this.

With FIDO, the user doesn't manually enter a 2FA token into a form field. Instead they press a button or something which directly transmits the token over SSL to the authentication server.

MITM is still possible, but there are other ways to combat that, such as TLS Channel IDs [1] or Bearer Tokens [2].

[1] http://www.google.com/intl/en/chrome/browser/privacy/whitepa... [2] http://www.browserauth.net/

Re: I found Prezi's source code

#260

Post by foldr »

antsar wrote: post #253
foldr wrote: post #243

Earlier quoted context omitted.

But Prezi aren't ethically responsible for paying the bounty. They stated the conditions pretty clearly and what he found wasn't within their scope.

That waives legal responsibility, but I fail to see how it affects ethics/morals. The ethical implications of an action are determined by the community/profession, so if the community agrees that this was unethical, it was.

This is some crazy entitlement culture. If you help someone out, you are not entitled to a reward. If you want a guaranteed reward for your efforts, get a contract first.
Post reply on HN