Post B41sOuhDPEa14pQLR2 by hansolo@lemmy.today
 (DIR) More posts by hansolo@lemmy.today
 (DIR) Post #B41sHeNTg9PSRIjEC8 by helloyanis@furries.club
       1 likes, 0 repeats
       
       I just found a security breach that can leak thousands of emails on a website!!Today, I snooped around on a website I won't mention the name of for privacy reasons, and they assign your account an user ID when you register.Well, with a very simple trick in the console I managed to get everyone else's email and account info (for example checking if they have a paid plan or not) by just lowering the user id, with no rate-limit on the endpoint!So a bad actor could send targetted phishing emails to people by telling them there is a problem with their payment!It's funny because on their homepage, they state they use "Military grade encryption" (whatever that means!), and their privacy policy says "We encrypt the transmission of that information" (does that just mean they do it over https?)So, moral of the story, don't trust companies with your personal info!I contacted the site, we'll see if they fix it.@privacy@lemmy.ml @privacy@lemmy.world @soatok#cybersecurity #privacy #web #hacking
       
 (DIR) Post #B41sHtlQTOTk9v346a by CodenameDarlen@lemmy.world
       0 likes, 0 repeats
       
       Is this AI? Something feels off.
       
 (DIR) Post #B41sHtyBhwgenV1Fzs by helloyanis@furries.club
       1 likes, 0 repeats
       
       @CodenameDarlen I'm glad I write well enough to be confused with AI but no, I haven't even used any em dashes! 😉
       
 (DIR) Post #B41sOuhDPEa14pQLR2 by hansolo@lemmy.today
       0 likes, 0 repeats
       
       I appreciate this post, but this is also a lot of “trust me, bro” to…well, trust.
       
 (DIR) Post #B41sOusYj3ebe0jP7I by helloyanis@furries.club
       0 likes, 0 repeats
       
       @hansolo Well, I can't really share more details without compromising the privacy of thousands of people who didn't ask for anything! I don't really know what else I can tell you? If the website does not fix it then I can disclose the vulnerability, but since there are accounts dating back to 2009 the code base must be super old and hard to fix so I'll give them some time.
       
 (DIR) Post #B41sOv4G1Z0mEICkLo by hansolo@lemmy.today
       0 likes, 0 repeats
       
       Sure, I get that. But I can also just as easily say the same thing and claim it is one of the largest companies in the world.You are 100% corect that we should not trust companies with our data. No argument there. Please just realize we might have some skepticism.
       
 (DIR) Post #B41sOvDTTINsgsW6iW by helloyanis@furries.club
       0 likes, 0 repeats
       
       @hansolo Well it is not one of the largest companies in the world, I can tell you that. You don't really have to trust me (but why would I post it if that wasn't true?)
       
 (DIR) Post #B41sOvMKwLTP8MfBWy by hansolo@lemmy.today
       0 likes, 0 repeats
       
       but why would I post it if that wasn’t true?Dozens of reasons, really. People do irrational stuff all the time.
       
 (DIR) Post #B41sOvT4XIrRTFoZ1s by helloyanis@furries.club
       1 likes, 0 repeats
       
       @hansolo Well, don't trust me then. I'm just a random person online after all! I'm not going to fight to prove something that I know happened, that would just be a pointless argument and a waste of time, I think.