Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'123456' password exposed chats for 64M McDonald's job applicants

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: '123456' password exposed chats for 64M McDonald's job applicants

#51

Post by shakna »

cobbal wrote: post #43
xeromal wrote: post #31

Earlier quoted context omitted.

I may be a dingleberry but who doesn't use uuidv4 for everything?

UUIDv4 may or may not use a cryptographically secure random number generator. Python's UUID library, for example, falls back to the insecure 'random' module. Given a handful of outputs, it's possible to predict future ones.

Uh... Come again?

    def uuid4():
        """Generate a random UUID."""
        return UUID(bytes=os.urandom(16), version=4)
https://github.com/python/cpython/blob/3.13/Lib/uuid.py

Re: '123456' password exposed chats for 64M McDonald's job applicants

#52

Post by whatsupdog »

ajsnigrutin wrote: post #18

It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)

Why does one even need an app for a fast food restaurant?

Re: '123456' password exposed chats for 64M McDonald's job applicants

#53

Post by jofzar »

My favourite part form the original report was that paradox had no way to find their security team ( to contact) and their security page just had "We worry about security, so you don't have to."

https://web.archive.org/web/20250208000940/https://www.parad...

Re: '123456' password exposed chats for 64M McDonald's job applicants

#54

Post by acuozzo »

whatsupdog wrote: post #52
ajsnigrutin wrote: post #18

It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)

Why does one even need an app for a fast food restaurant?

1. You can exchange privacy for 20% off.

2. Many franchises have a crummy PA system, so you can avoid this if you plan on using the drive-through.

3. Customization. It's very tedious for all involved to repeatedly request "no cheese", "no ice", "extra sauce", etc. for a very large (e.g., $100+) order.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#55

Post by Keverw »

parpfish wrote: post #40
ceejayoz wrote: post #34

Earlier quoted context omitted.

The McDonalds consumer-facing app is quite possibly the worst app from a major company I've ever encountered. It's shockingly bad.

The UI is atrocious. I do computers for a living and can barely navigate and figure out what’s going on.

I noticed it freezes up on me sometimes when I open it. I assume something is blocking instead of being asynchronous when it pings their servers, but instead of waiting to dismiss a loading screen it just shows the full app and like freezes.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#57

Post by rahimnathwani »

ceejayoz wrote: post #34
ajsnigrutin wrote: post #18

It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)

The McDonalds consumer-facing app is quite possibly the worst app from a major company I've ever encountered. It's shockingly bad.

It can be confusing for new or infrequent users.

I use it once a week and I don't find it annoying at all, except for the bug where it will let you complete an order for an airport McDonald's, and then soon after automatically cancel the order.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#58

Post by overfeed »

lelandbatey wrote: post #15
hardwaresofton wrote: post #9

Earlier quoted context omitted.

A third problem that senior engineers might recognize: using numeric IDs on an outward facing object. UUIDs would have made this impossible as well

Using numeric IDs on an outward facing object is, for the most part, totally fine. It's a serious tradeoff to ditch the nice properties of numerical IDs and the legibility they provide in order to cargo-cult a "we must reveal nothing" approach, as you would here via UUID. It also misses the point of the actual security lesson: no matter the identifier, you need to be applying access controls to your data. Even if you…

> If all it takes to gain access to a thing is knowing the identifier of that thing, you've blown it in a huge way.

Defense in depth is a thing, so even if you make a mistake in one place, and the attacker gets complete access - as what happened with the McApplicaton here - they won't be able to download your entire db within minutes. Even with zero authentication, non-guessable identifiers will slow down the exfiltration by several factors from dozens/hundreds of records per second to one record per $MANY_DAYS, with lots of 404s for the defenders to look at.

> That means you'll probably leak them, expose them, or other folks will collect them (often incidentally via things like system logs)

The additional friction of acquiring the UUIDs from a different channel is beneficial to defenders, compared to decrementing or incrementing IDs, which is trivial to do, and doesn't need RCE. It's the difference between "All users' data was exfiltrated" and "Only a couple/handful of accounts were affected", and this can make or break the breached company.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#59

Post by brikym »

whatsupdog wrote: post #52
ajsnigrutin wrote: post #18

It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)

Why does one even need an app for a fast food restaurant?

I don't eat that junk but my understanding is McDonald's have segmented their customers into two groups:

1) People who just want to eat McDonald's now and don't care about apps. They will put up with the normal prices which are quite high now.

2) Cheapskate people who wouldn't go to McDonald's much due to the pricing, but can be enticed to go through deals in the app they are happy to jump through hoops to get.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#60

Post by sam_lowry_ »

hardwaresofton wrote: post #42
jszymborski wrote: post #38

Earlier quoted context omitted.

Ok, this is probably a stupid, very bad, no good idea considering I've not heard of people doing this, but can't you retain many of the benefits of numerical IDs but also the secrecy of UUIDs by using an HMAC ? With HMAC, you can still ask for some sequential IDs SipHash128(0, KEY) = k_0 SipHash128(1, KEY) = k_1 You get the same number of bits as a UUID. You can't, however, sort by IDs to get their insertion sequence…

You could also "just" have an internal-use only numeric ID, or use a UUIDv7.

or ULIDs or any other partially sortable ids.
Post reply on HN