Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone

Post reply on HN
Print view View original

351–354 of 354 posts

Re: When you browse Instagram and find Tony Abbott's passport number

#351

Post by stjohnswarts »

kccqzy wrote: post #26

Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…

Why not use a randomized blur so people who like to do such things can waste time trying to figure it out when it's actually nothing but random numbers and has none of the original info?

Re: When you browse Instagram and find Tony Abbott's passport number

#353

Post by pathseeker »

saberdancer wrote: post #336
Aeolun wrote: post #331

Earlier quoted context omitted.

You shouldn’t arbitrarily include or exclude information. The response to a given input should always be the same output, and not depend on what API key you are calling with.

I agree. Using API key to determine what kind of information is returned is a strange solution. It would effectively mean that if the airline is developing an application that has multiple levels of users (airline employees, customers, admins) it would need to store and use multiple API keys to retrieve the data. Ofcourse, real solution here is that the airline software should not just pass along everything it receiv…

Well unfortunately that's just not how the real world works. In most production systems you are going to end up with a bunch of fields that aren't visible to regular users. There ends up being a whole bunch of roles that need access to different levels and instead of implementing separate APIs for every user type, you just mask out the fields a specific type isn't allowed to see.

This is frequently called property level authorization or field level authorization.

https://stackoverflow.com/questions/30002351/enforcing-prope...

https://help.salesforce.com/articleView?id=security_data_acc...

You're just wording it in an indirect way to make it seem like something different. It's not "Using API key to determine what kind of information is returned", it's "hiding sensitive fields based on permissions".

Re: When you browse Instagram and find Tony Abbott's passport number

#354

Post by pathseeker »

Aeolun wrote: post #331
pathseeker wrote: post #284

Earlier quoted context omitted.

This is pretty standard when fetching entire complex objects from many backends. You get the full object with all of the fields the authorization layer allows you to see. Something like "GET /reservation/ " would rarely require you to specified the 50 fields that you would like included in the response. Many offer fields to explicitly filter for specific things, but the default is almost always to return the full obj…

You shouldn’t arbitrarily include or exclude information. The response to a given input should always be the same output, and not depend on what API key you are calling with.

It's not arbitrary. It's based on authorization levels for object properties/fields. If you haven't encountered this it's likely that you haven't spent much time working on a system with many different distinct classes of actors.

Developing a different getUser API for 20 different caller types does not scale.

Post reply on HN