Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler’s amateur coding could come back to haunt Capitol Hill rioters

arstechnica.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#41

Post by wmil »

Ancapistani wrote: post #30

If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…

> My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to collect the data going to be subject to federal charges?

Realistically the FBI won't be eager to file charges to protect a company seen as a Biden opponent.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#42

Post by gknoy »

dragontamer wrote: post #39
nwsm wrote: post #37

Earlier quoted context omitted.

Were these posts private? I've never been on Parler so I have no idea, but I'm not reading anything that suggests they were direct messages or "private" accounts making the posts.

They were marked "deleted". Which means the privacy question is a bit ambiguous. They were public at one point, but at the time they were leaked out, they had a deleted flag and clearly were meant to be private. IANAL, but I'd expect it to be illegal to grab data marked "deleted". If you were a few hours earlier and archived them before they were deleted, that probably would be legal.

If I walk up to someone's house and say, "Hey can I have a copy of the seventh book in the third drawer of your nightstand" (e.g. `/api/books/03/07`), and you say "Sure here you go", it seems like it should be hard to argue that you have any expectation of privacy (for things that you are giving out freely) -- even if that book was something like your diary. HTTP codes for denying access exist specifically for this reason.

Of course, the iteration of accounts that Weev was convicted of was nearly exactly this, so we know that this doesn't always hold true, but it really is baffling why.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#43

Post by mxxx »

freewilly1040 wrote: post #16
commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

Why is the auto incrementing ID bad? Easier to scrape, I suppose, if the db ID was in the URL

If you’re not requiring any level of authorisation to enable someone to read a post (ie, this post has been removed, you can’t see it any more or this is a private post, you must be a friend of its author to see it), then you’re just relying on people not being about to guess it’s ID and grab it from the API. It’s a poor version of security through obscurity. Could have easily been rectified by using UUIDs instead of sequential integers (which is what I’m _guessing_ they used)

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#44

Post by frollo »

mxxx wrote: post #43
freewilly1040 wrote: post #16

Earlier quoted context omitted.

Why is the auto incrementing ID bad? Easier to scrape, I suppose, if the db ID was in the URL

If you’re not requiring any level of authorisation to enable someone to read a post (ie, this post has been removed, you can’t see it any more or this is a private post, you must be a friend of its author to see it), then you’re just relying on people not being about to guess it’s ID and grab it from the API. It’s a poor version of security through obscurity. Could have easily been rectified by using UUIDs instead of…

They used sequential integer, which means it wasn't even security through obscurity. There wasn't any form of security. Not even a post it with "please don't hack me".

With a browser and enough time at hand even my grandfather could have dumped their whole DB.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#45

Post by inkeddeveloper »

dragontamer wrote: post #33
Ancapistani wrote: post #30

If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…

IANAL, but... I expect the hackers to be subject to federal crimes. As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent. If one party clearly wanted a message to be private, it is illegal to open that message. ------ In contrast, a Postcard h…

if you're accessing a public api, you're not a hacker.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#46

Post by dragontamer »

inkeddeveloper wrote: post #45
dragontamer wrote: post #33

Earlier quoted context omitted.

IANAL, but... I expect the hackers to be subject to federal crimes. As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent. If one party clearly wanted a message to be private, it is illegal to open that message. ------ In contrast, a Postcard h…

if you're accessing a public api, you're not a hacker.

A lot of web-infrastructure is public API these days. If someone misconfigures their S3 instances and allows the public to access it... accessing internal S3 data (despite being from a public API) is considered hacking IIRC.

The law doesn't care about how easy or hard it is to perform the hack. All it cares is about intent.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#47

Post by curlypaul924 »

LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

> From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber.

How is/was Parler different from Facebook in this regard? Facebook makes money on ads, so the longer you stay on their site, the more money they make. One way to get people to stay longer is by encouraging the sorts of posts that gets people riled up.

I'm not accusing Facebook of being complicit in the events of last week, but from personal observation, I see a lot more low-effort, angry posts on Facebook than I do on Twitter or Reddit.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#48

Post by LarryDarrell »

curlypaul924 wrote: post #47
LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

> From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. How is/was Parler different from Facebook in this regard? Facebook makes money on ads, so the longer you stay on their site, the more money they make. One way to get people to stay longer is by encouraging the sorts of posts that gets people riled up. I…

Yes, the mechanism is the same.

However, Facebook has lines that when crossed result in being moderated. Their moderation system is obviously imperfect and a lot of the time they act too late, but it's there.

Parler was courting all the line-crossers with the promise that there would be no such moderation on their platform. That ended with predictable results.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#49

Post by webinvest »

dragontamer wrote: post #33
Ancapistani wrote: post #30

If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…

IANAL, but... I expect the hackers to be subject to federal crimes. As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent. If one party clearly wanted a message to be private, it is illegal to open that message. ------ In contrast, a Postcard h…

> IANAL, but... I expect the hackers to be subject to federal crimes.

Only if they’re in the USA based on their IP address or online testimony.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#50

Post by mikewarot »

jasonladuke0311 wrote: post #19
whatshisface wrote: post #10

Earlier quoted context omitted.

> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.

So it was a honeypot.

If this twitter thread is right, it sure does look like honeypot

https://twitter.com/davetroy/status/1327253991936454663?lang...

Post reply on HN