A family tracking app was leaking real-time location data • Hacker News Board

Re: A family tracking app was leaking real-time location data

#41

Post by jmull » Fri, Apr 12, 2019, 5:53 PM UTC

glvn wrote: post #16

jmull wrote: post #11

As bad as it is, I can understand accidentally leaving a database accessible (they generally need to be accessible and setting just the right amount of accessible can be complex). But this: > ...plaintext passwords... Why, oh why, store plaintext passwords?!?

I can sort of see why and it's for the same reason databases are left wide open. You start a project. You set up a DB with minimal security because you're just starting the project, and you figure that down the road before you release to the public, you will secure that DB. A few weeks/months pass and you are ready to release your app into the wild. But by that time you are focused on other things and that unsecured…

The password still has to get into the database... something passes it to an insert query or request. It just needs to hash the password on its way through. Let’s see:

* identify a hashing library * install/import it * call it (when storing the password and when comparing)

It’s a matter of minutes really.

Re: A family tracking app was leaking real-time location data

#42

Post by whenchamenia » Fri, Apr 12, 2019, 6:40 PM UTC

rootusrootus wrote: post #10

willio58 wrote: post #6

Earlier quoted context omitted.

Yes. They are terrible. My mother uses it on my teenage brother so much that he actually leaves his phone places so she thinks he’s somewhere he isn’t. So in wanting to keep your child safe by checking these apps often, you can make them _less_ safe and more dishonest.

That's not a problem with the app.

It is a root problem the app embodies.

Re: A family tracking app was leaking real-time location data

#43

Post by darkarmani » Fri, Apr 12, 2019, 8:03 PM UTC

unixpickle wrote: post #7

Not the first time someone left a MongoDB database exposed to the wild, and it won't be the last. It's an easy thing to do, especially since MongoDB is so popular for small single-server projects. A few years ago, I discovered the open MongoDB database of an educational website called Kaizena, which we were using in my high school English class. When I reported the problem to them, they quickly fixed it (probably wit…

For many years Mongo would not allow you to use only Unix Domain sockets. It would always create a TCP socket as well, making it harder to secure, and nearly impossible to secure against other processes running on the server.

https://stackoverflow.com/questions/21421410/how-to-disable-...

Re: A family tracking app was leaking real-time location data

#44

Post by rootusrootus » Fri, Apr 12, 2019, 11:15 PM UTC

whenchamenia wrote: post #42

rootusrootus wrote: post #10

Earlier quoted context omitted.

That's not a problem with the app.

It is a root problem the app embodies.

We manage to use the app without this problem. Everybody participates willingly.

Re: A family tracking app was leaking real-time location data

#45

Post by bobbydreamer » Sat, Apr 13, 2019, 7:31 PM UTC

We should let google do it and give us the details, they do it better as they have already invested a lot in it, doing it and keeping it as secret or FB do it. Basically an Android app asking other person to accept to track their location and send it to other person when they want it. It should be that simple.