Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

61–70 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#61

Post by School-Cotton »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

That’s incredible

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#62

Post by mulmen »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

Did you try adjusting price?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#63

Post by mulmen »

auxiliarymoose wrote: post #42
dmitrygr wrote: post #8

Earlier quoted context omitted.

Don't get too excited. They never said what kind of hash. Given the rest of the site's security design, might have easily been unsalted md5

Or maybe rot26 — I've heard it's twice as secure as rot13!

It’s 2025, you should at least be on rot52.

Best practice guide: https://github.com/killerk3emstar/rot52

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#64

Post by gausswho »

iancarroll wrote: post #14
intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

Actual legal threats are uncommon but I have seen some companies try to offer a bribe disguised as a retroactive bug bounty program, in exchange for not publishing. Obviously it is important to decline that.

Decline because it'd mean you were profiting off of a crime? Or that the opportunity of publishing has higher value than the bribe?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#65

Post by logicallee »

nradov wrote: post #53
awesome_dude wrote: post #32

Rule 1. NEVER trust user supplied data. Once that rule was broken, any other rules broken became clear to everyone

Never trust any data. Even if the data comes from a partner or internal system it could be compromised or defective.

>Never trust any data. Even if the data comes from a partner or internal system it could be compromised or defective.

I don't even call it data anymore. I call it datain't.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#66

Post by auxiliarymoose »

mulmen wrote: post #63
auxiliarymoose wrote: post #42

Earlier quoted context omitted.

Or maybe rot26 — I've heard it's twice as secure as rot13!

It’s 2025, you should at least be on rot52. Best practice guide: https://github.com/killerk3emstar/rot52

Ah, thanks! Hard to keep up with this stuff. Next thing you know the boffins will tell us we need to switch to rot104 or even rot208 because of "post-quantum cryptography" or something.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#68

Post by LoganDark »

gausswho wrote: post #64
iancarroll wrote: post #14

Earlier quoted context omitted.

Actual legal threats are uncommon but I have seen some companies try to offer a bribe disguised as a retroactive bug bounty program, in exchange for not publishing. Obviously it is important to decline that.

Decline because it'd mean you were profiting off of a crime? Or that the opportunity of publishing has higher value than the bribe?

Decline because the public deserves to know the company has that approach to security.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#69

Post by esseph »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

I love this so much
Post reply on HN