Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's inside the QR code menu at this cafe?

peabee.substack.com

Post reply on HN
Print view View original

1–10 of 328 posts

Re: What's inside the QR code menu at this cafe?

#3

Post by kapitanjakc »

I found similar vulnerability in Bus State transport facility of government, where you can get list of everyone who did reservation online.

You can get their gender, age, name, mobile number.

I simply reported it to their website's support email and state cyber cell.

This was 7 years ago, that vulnerability still exists.

Re: What's inside the QR code menu at this cafe?

#4

Post by lordgrenville »

laeri wrote: post #2

I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.

The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.

Re: What's inside the QR code menu at this cafe?

#6

Post by krab »

Nice find!

There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it.

> They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country.

If that's about the worst thing you can actively do, then it's only about the data leak.

Re: What's inside the QR code menu at this cafe?

#8

Post by globular-toast »

laeri wrote: post #2

I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.

If you discovered an incompetent healthcare provider was prescribing antibiotics for every condition would you "contact them privately" or contact the relevant authorities?

Private disclosure is for when you believe the company cares about security but made a genuine mistake. For the company in the OP it would be more like free education in fundamental privacy and ethics. They're not entitled to that. Name and shame.

Re: What's inside the QR code menu at this cafe?

#9

Post by inquisitor26234 »

desultir wrote: post #5
laeri wrote: post #2

I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.

is it really a vulnerability if the entire thing is open by design?

same thoughts, annual reports of larger companies have more dense figures than these too.

Re: What's inside the QR code menu at this cafe?

#10

Post by sschueller »

krab wrote: post #6

Nice find! There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it. > They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country. If that's about the worst thing you can actively do, then it's only about the data leak.

Aren't phone numbers being leaked if you iterate over the tables?
Post reply on HN