Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

71–80 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#71

Post by notatoad »

citricsquid wrote: post #3

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

don't confuse the URL structure with the application design. just because the url is /user/87/edit doesn't mean that there is a file called edit inside a folder called 87. almost any modern web development framework lets you create whatever URLs you want. i'm sure, internally, that every user's edit panel is powered by the same code.

Re: Never Give Your Information To 10 Minute Old Startups

#72

Post by jspthrowaway »

smeagol wrote: post #68
jspthrowaway wrote: post #49

Earlier quoted context omitted.

Contacted a PR person in between the last thread and this one, I'm guessing? That's a rapid 180. You have a long way to go in my mind, in terms of fixing the initial response. You probably have help now, which is great, but your initial kneejerk demonstrates underlying trouble to me which you need to fix. You're in a tough spot, too, because you can't delete those godawful comments without looking suspicious.

huh? you realize this was a pet project right? we're two dudes with no jobs.

You repeatedly write some form of that assertion (we're two nerds) as if it is supposed to excuse something. I honestly couldn't give a rat's ass regarding who you are. I care about your actions and your actions alone. Stop making excuses!

I'd like you to apologize not only for the disclosure, but also to the reporter for how you treated him in the other thread. The entire other thread of your responses is disgusting, and you don't get to write it off because of your gender, quantity, or employment status. Own your comments and stop excusing them with that bullshit line.

I have to admit that I would also be pleased if your service disappeared until you're working with somebody who has a little more experience with secure Web applications; this mistake betrays your experience. Since we all started somewhere, though, I can only hope you fix this on your own.

Re: Never Give Your Information To 10 Minute Old Startups

#73

Post by mattdeboard »

sergiotapia wrote: post #59

Holy shit! I consider myself a mediocre programmer at best and even I wouldn't make such a dumb mistake. This is literally something only a amateur would do. I'm just awe struck that this would even happen. How?

Beware the mistake you think you'll never make :)

Re: Never Give Your Information To 10 Minute Old Startups

#74

Post by notatoad »

alyx wrote: post #7

To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.

still... developing an application and then bolting on some security over top of it later seems like a recipe for disaster. And pushing it to a public server before any security has been implemented is a very stupid thing to do.

Re: Never Give Your Information To 10 Minute Old Startups

#76

Post by tylermenezes »

patio11 wrote: post #27

Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure." This incentivizes people to fix things quickly and preserves the reputational value of break…

I think it's at an entirely different level when it's a brand new company and a trivial security flaw. That just seems like incompetence, and he's absolutely right to suggest not trusting people like that with your data.

Re: Never Give Your Information To 10 Minute Old Startups

#78

Post by metalruler »

Another hole that has been exploited in the past (speaking generally here, not about this specific startup) is a password reset function that confirms the email address it is sending the password/recovery link to. If the accounts are sequentially numbered, it's a trivial exercise to fetch a reset link for each member, and scrape the email address returned.

Re: Never Give Your Information To 10 Minute Old Startups

#79

Post by [deleted] »

adgar2 wrote: post #47
zacharyvoase wrote: post #21

Earlier quoted context omitted.

'Relatively senior' here means 'ostensibly trusted with important tasks in the past'. Both of the creators of this application (I won't say 'founders of this startup' because that's silly) are ex-WePay.

I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding. I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.

[deleted]

Re: Never Give Your Information To 10 Minute Old Startups

#80

Post by ainsleyb »

jspthrowaway wrote: post #42
patio11 wrote: post #27

Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure." This incentivizes people to fix things quickly and preserves the reputational value of break…

He submitted this article after the vulnerability was already fixed. (I grant that the initial comment came before.) I'd be inclined to agree with you, overall, save for a couple mitigating factors in this case: 1) The founder's behavior in the other thread, including refusing to notify affected parties. 2) Such a simple mistake worries me about what else might be vulnerable in the application which is built to handl…

Legally, they're now required by law to disclose to their users of a security breach: http://en.wikipedia.org/wiki/Security_breach_notification_la...

Since whomever discovered the bug was able to access others' sensitive information, they have to disclose.

Post reply on HN