Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

41–50 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#41

Post by maxbond »

scq wrote: post #22
veqq wrote: post #16

Earlier quoted context omitted.

What hash do you use?

bcrypt is the industry standard.

`bcrypt` is probably the "standard" in the sense that it has the widest adoption, but since 2015 [1] the "standard" in terms of what you should recommend for new work has been `argon2id` (and you can find parameter recommendations here [2]).

[1] https://en.wikipedia.org/wiki/Password_Hashing_Competition

[2] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#42

Post by auxiliarymoose »

dmitrygr wrote: post #8
luxuryballs wrote: post #3

well at least it was a password hash :D

Don't get too excited. They never said what kind of hash. Given the rest of the site's security design, might have easily been unsalted md5

Or maybe rot26 — I've heard it's twice as secure as rot13!

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#44

Post by necovek »

mvkel wrote: post #37

[flagged]

As pointed out, this is unrelated to GDPR.

Many countries in Europe require you to register with the local police any visitors you are hosting and pay a visitor's tax: this is why hotels would ask for the same documents too.

GDPR should help ensure they only keep the passport data until they complete the registration, and then remove it after some time or at your request.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#45

Post by intheitmines »

iancarroll wrote: post #14
intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

Actual legal threats are uncommon but I have seen some companies try to offer a bribe disguised as a retroactive bug bounty program, in exchange for not publishing. Obviously it is important to decline that.

Thanks, its cool to hear attitudes have changed.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#49

Post by maxbond »

whatever1 wrote: post #7

Just use a framework to build your site. Don’t reinvent the wheel!

There are some vulnerabilities frameworks can address wholesale (like CSRF or XSS) as long as you keep to the blessed way of doing things, but they aren't able to save you from a complete failure to build authorization into your API. Like how seatbelts save lives but can't stop you from accelerating directly into a pole if you choose to do so.
Post reply on HN