Governor vows criminal prosecution of reporter who found flaw in state website

Re:Governor vows criminal prosecution of reporter who found ... by kirlfiend_grill on Thursday October 14, 2021 @05:01PM (#28870056)

I let a company know that the url for their receipts (including name, address etc) was simply an md5 of the order number. They graciously offered 15% off on my next order as a thank you.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by Something1234 on Thursday October 14, 2021 @08:34PM (#28872288)

I feel like that would be a decent option for a surrogate key for public identification of an item and potentially cheaper than generating a uuid or something else. Maybe combine that with a salt and you have alright protection. How did you figure out that it was an md5 of the order number?

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by cryptofistMonk on Thursday October 14, 2021 @08:41PM (#28872363)

Presumably order numbers are easily guessable, so the md5 really offers no protection at all in this case and is no better than just using the order number

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by exikyut on Saturday October 16, 2021 @09:12AM (#28887631)

And the thing is, even if they can't be guessed, it's only 999,999 calls to try every 6-digit possibility. And you'd only take 11 days if you were nice and paced yourself to 1 req/sec.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by renonce on Thursday October 14, 2021 @08:48PM (#28872414)

Searching for that MD5 would probably be sufficient to find that out.

[ Parent | on HN ]