News for hackers. Stuff that matters.

A comment on Post-Mortem and Security Advisory: Data Exposure After travis-ci.com Outage. Parent comment

Re:Post-Mortem and Security Advisory: Data Exposure After tr... by cyrusaf on Monday April 09, 2018 @02:56AM (#16790965)
It's possible their truncate also restarted the sequence: "TRUNCATE TABLE users RESTART IDENTITY;"

https://stackoverflow.com/questions/13989243/sequence-does-n...

Although, I am confused about how sign ins created new users. When they say sign ins, do they mean new accounts?

[ Parent | on HN ]
Re:Post-Mortem and Security Advisory: Data Exposure After tr... by catfood on Monday April 09, 2018 @03:12AM (#16791019)
Yeah they must mean new accounts, if not then I'm lost. I guess it could have reset autoincrement but they said it didn't. The only other thing I can think of is that the signed token that's put in localStorage is sent to the server like "someuser|sometoken", the server inspects sometoken, says it checks out, then takes the client at its word that it's someuser.
[ Parent | on HN ]
Re:Post-Mortem and Security Advisory: Data Exposure After tr... by inopinatus on Monday April 09, 2018 @03:13AM (#16791021)
A sign-in can result in an automatic account creation when using federated identity.
[ Parent | on HN ]