Interestingly, Ashton Cofer and Teddy Solomon of Fizz tried some PR damage control when their wrongdoing came to light https://stanforddaily.com/2022/11/01/opinion-fizz-previously.... Their response was weak and it seems like they've refused to comment on the debacle since then.
When your classmates threaten you with felony charges
41–50 of 350 posts
Re: When your classmates threaten you with felony charges
#42A private individual or company cannot file criminal/felony charges. Those are filed by a County Prosecutor, District Attorney, State Attorney, etc after being convinced of probable cause. They could threaten to report you to the police or such authorities, but they would have to turn over their evidence to them and to you and open all their relevant records to you via discovery. > Get a lawyer Yes, if they're seriou…
Yes, threatening to report is what was really happening here. But in their effort to scare us, they elided much of that process. From our perspective it was "watch out, you might face felony charges if you don't agree to silence".
[deleted]
Re: When your classmates threaten you with felony charges
#43The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information.…
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…
If I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if
user.email == collection.email.
Re: When your classmates threaten you with felony charges
#44The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information.…
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…
I think deleting a scooter is against some law of conservation :)
Re: When your classmates threaten you with felony charges
#45> And at the end of their threat they had a demand: don’t ever talk about your findings publicly. Essentially, if you agree to silence, we won’t pursue legal action. Legally, can this cover talking to e.g. state prosecutors and the police as well? Because claiming to be "100% secure", knowing you are not secure, and your users have no protection against spying from you or any minimally competent hacker, is fraud at m…
They could be legitimately ignorant of their security vulnerabilities. That might go to negligence more than fraud.
[deleted]
Re: When your classmates threaten you with felony charges
#46Earlier quoted context omitted.
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…
If I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if user.email == collection.email.
Doing authorization within firestore breaks down instantly outside of toy applications.
Re: When your classmates threaten you with felony charges
#47Earlier quoted context omitted.
I'm not even suggesting it has to happen at a legal level, but perhaps at a professional level, I would think any lawyer writing baseless threatening letters to people should be subject to losing there license.
Writing a demand letter that leans in favor of your client's interests is not only okay, it is the standard course of action for a civil dispute. https://www.law.cornell.edu/wex/demand_letter
Perhaps they shouldn't. If we lived in a world where lawyers were more cautions about what they attached there name to out of concern for losing their license we would probably be better off. Less bullying by corporations with lots of money etc. No problems with demand letters for legitimate issues that are well supported by evidence though.
Re: When your classmates threaten you with felony charges
#48The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information.…
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…
One interesting thing about the statute of limitations is “the discovery rule.”
For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right?
No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until they do.
Accordingly, if the scooter company read a post today about a hack that happened “a long time ago” and therein discovered their loss, the statute of limitations would begin to tick today and the hacker could be in legal jeopardy for two more years.
Re: When your classmates threaten you with felony charges
#49Earlier quoted context omitted.
Only for uses of the word 'terrorism' so hyperbolic as to be meaningless.
Just pointing out the absurdity of it. I would much rather get punched in the face than serve 20 years in prison, but it is illegal to threaten the former, but perfectly fine to threaten the latter.
>I would much rather get punched in the face than serve 20 years in prison, but it is illegal to threaten the former, but perfectly fine to threaten the latter.
How about you don't do the action that makes you punishable with 20 years in prison?
On a more practical level, if someone is breaking into your house, should it be illegal to tell them to stop, on pain of you calling the police which presumably would cause them to be incarcerated?
Re: When your classmates threaten you with felony charges
#50Earlier quoted context omitted.
Only for uses of the word 'terrorism' so hyperbolic as to be meaningless.
Just pointing out the absurdity of it. I would much rather get punched in the face than serve 20 years in prison, but it is illegal to threaten the former, but perfectly fine to threaten the latter.
The person sending the letter also doesn't have a prison nor the power to put anyone in it. It is a persuasive legal letter stating someone's opinion about what someone else could potentially do.
A more equal comparison might be "If you tease a gorilla they might seriously hurt you"