iViewed your API keys

Re:iViewed your API keys by jacobsenscott on Thursday April 14, 2022 @11:28AM (#31028199)

Also in the US, where you can be sentenced to 41 months in prison for browsing a public URL at AT&T, and where the the Governor of Missouri wants to make it illegal to view the html source of a web page (because some state web site leaked all the SSNs of their teachers in some hidden html or something).

If I found something like this on a site I don't think I would notify anyone. Too risky. Maybe over TOR if they have a contact page or something. But it is hard to be anonymous these days.

[ Parent | on HN ]

Re:iViewed your API keys by legalcorrection on Thursday April 14, 2022 @12:35PM (#31029325)

weev didn’t just “browse a public url at AT&T”. That is dishonestly reductionist. He noticed the bug and then used it to retrieve and make public the private data of over a hundred thousand people.

[ Parent | on HN ]

Re:iViewed your API keys by jacobsenscott on Thursday April 14, 2022 @08:19PM (#31035202)

My understanding was they just sent random icc-id codes as a query parameter to a public url, and if you hit a valid id it returned an email address. It was working as "designed", and not a bug.

[ Parent | on HN ]

Re:iViewed your API keys by aspenmayer on Thursday April 14, 2022 @03:03PM (#31031725)

The data was already publicly available. Didn’t he just publicize the url?

[ Parent | on HN ]

Re:iViewed your API keys by getcrunk on Thursday April 14, 2022 @08:25PM (#31035244)

You are equivocating. Iirc this bug you refer too WAS the public urls

[ Parent | on HN ]

Re:iViewed your API keys by legalcorrection on Thursday April 14, 2022 @10:45PM (#31036153)

So? You access a few accounts that way, realize you're accessing people's private info, and then stop. No one is gonna charge you for that. Write a script and download a hundred thousand people's private data, that's a whole different thing.

[ Parent | on HN ]