News for hackers. Stuff that matters.

A comment on Hacking Grindr Accounts with Copy and Paste.

Re:Hacking Grindr Accounts with Copy and Paste by tiku on Saturday October 03, 2020 @02:54AM (#24670156)
Must be some framework that has this behaviour as default. Else it would be really really bad.
[ Parent | on HN ]
Re:Hacking Grindr Accounts with Copy and Paste by mskec on Saturday October 03, 2020 @03:25AM (#24670283)
What would be the use case for a framework that returns password reset token to random user requesting password reset of another account. Token must only be available to account owner.

A framework like this should not be used.

[ Parent | on HN ]
Re:Hacking Grindr Accounts with Copy and Paste by woutr_be on Saturday October 03, 2020 @08:33AM (#24671573)
This seems to be fairly deliberate, the QR code might probably give you some clues. They needed to generate a QR code so the user could just scan it and reset their password.
[ Parent | on HN ]