iViewed your API keys
wale.id.au
iViewed your API keys
1–10 of 116 posts
Re: iViewed your API keys
#2No post body was provided.
Re: iViewed your API keys
#3I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity.
It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate.
I understand the desire for recognition, but certainly think twice and at the very least wait until after election season is over in June so tech-illiterate political opportunists don't pounce to martyr you for their own gain.
Would suggest looking into the fall of someone widely recognised like Dr Vanessa Teague, a professor who pointed out government failures in e-voting and claimed health anonymization measures to make up your own mind. One government department finally had enough and she was out, I'm sure it's a lot cheaper than actually fixing the problems raised.
Behind the laid back "beers and beaches" mirage, Australia is an authoritarian country with huge public support for iron fists, this is clear to many.
Re: iViewed your API keys
#4I'm not a web developer but this stuff, from the outside looking in, is reason enough for me to avoid. Obviously I'm no expert but this sort of stuff happens enough that I wouldn't even know where to start to learn this stuff properly.
Re: iViewed your API keys
#5I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…
The same applies in the US, unfortunately.
Re: iViewed your API keys
#6To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programming, it is just skipping an essential step.
How do you provide your secrets to your apps? Using an external service? That would still require another set of credentials. Using environment variables? A file only the user running the app has access too? Another way?
Re: iViewed your API keys
#7I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…
Completely agree. The AU Gov would probably call this hacking
Re: iViewed your API keys
#8I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…
The same applies in the US, unfortunately.
See: this ad from Gov Parson in response to a disclosure about a state website leaking social security numbers of teachers
Re: iViewed your API keys
#9I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…
Thankfully, I already disclosed the issue to iView's engineer team back in December 2021, and a lot of the original data has since been removed from the site. I do try to take care of this issue by censoring a lot of information about the security issue in the write-up, but I'm not sure if that is enough.
Re: iViewed your API keys
#10To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…
The step they seem to be missing is _the entire development process_.
If you're using API keys to access stuff, you do it on your backend, there's no excuse for that stuff to make it to the frontend.
If your "client" needs access to sensitive API keys, you need to rethink your architecture.
As a (senior) backend software engineer, this reeks of a person/team who doesn't know how to architect and/or implement web applications/software.