News for hackers. Stuff that matters.

A comment on Judge refuses to reinstate Parler after Amazon shut it down. Parent comment

Re:Judge refuses to reinstate Parler after Amazon shut it down by snoshy on Thursday January 21, 2021 @11:13PM (#25868236)
For sure. I shared this in another comment earlier, but they literally were using a free trial of Okta [1] to secure prod. This is why all of their user data got leaked. Their code was written to fail open, so if Okta didn't respond for some reason to auth requests, access was granted by default.

[1] https://twitter.com/okta/status/1348191370528256002

[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by duskwuff on Thursday January 21, 2021 @11:20PM (#25868277)
My understanding is that that was a myth. The data which was exfiltrated from Parler was retrieved through their mobile API, which allowed for easy enumeration of content and didn't implement some expected access controls (like blocking access to deleted content).
[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by ashtonkem on Thursday January 21, 2021 @11:25PM (#25868315)
Them using a trial version is not a myth; that is from the official Okta Twitter account.

My understanding of the scraped data is that some APIs used both sequential keys, and ignored both permissions and their soft delete flag. It’s not clear to me whether or not that API was permanently unauthenticated, or if it failed open once Okta locked them out.

[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by duskwuff on Thursday January 21, 2021 @11:36PM (#25868357)
That API was effectively public by design. It's the same API that anyone using the Parler mobile app would have been accessing.
[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by tptacek on Thursday January 21, 2021 @11:40PM (#25868374)
That API --- their most obvious, public API --- appears to have done no authz, despite using sequential identifiers. There are private feeds on Parler. That's clownish. I don't understand why anyone would trust them going forwards.
[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by ashtonkem on Thursday January 21, 2021 @11:50PM (#25868431)
I don’t understand either, but lots of people appear to be doing lots of things I don’t understand. So I’m going to assume that people will continue us to trust them going forward, even if I think they shouldn’t.
[ Parent | on HN ]
Re:Judge refuses to reinstate Parler after Amazon shut it down by tptacek on Friday January 22, 2021 @12:26AM (#25868629)
I don't know what the pill color for this is, but, like, welcome to the desert of the real and all that.
[ Parent | on HN ]