this post was submitted on 13 Feb 2024
83 points (98.8% liked)

Technology

71955 readers
3054 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
83
How Spoutible’s Leaky API Spurted out a Deluge of Personal Data (www.troyhunt.com)
submitted 1 year ago by stopthatgirl7@kbin.social to c/technology@lemmy.world
6 comments fedilink hide all child comments
 

Ever hear one of those stories where as it unravels, you lean in ever closer and mutter “No way! No way! NO WAY!” This one, as far as infosec stories go, had me leaning and muttering like never before. Here goes: Last week, someone reached out to me with what

you are viewing a single comment's thread
view the rest of the comments
[–] Psaldorn@lemmy.world 6 points 1 year ago* (last edited 1 year ago) (1 children)

They might as well just publish the database credentials in the API too, jeez

[–] elvith@feddit.de 6 points 1 year ago (1 children)

They basically did. I bet they just used an ORM in the backed and then pointed the API endpoint to the user entity without filtering the fields. This results in a dump of the user table (although row by row indexed by users instead of a full dump)

[–] snooggums@kbin.social 2 points 1 year ago

Ahhhh, I was.wondering why they would take the time to set up an API with that data and forgot that almost everything has a way to just dump things into it without needing to be set. I forget because where I work we actively avoid that approach because of risks like this.