News for hackers. Stuff that matters.

A comment on Stealing $20M Worth of Magic: The Gathering Cards in a Single Request. Parent comment

Re:Stealing $20M Worth of Magic: The Gathering Cards in a Si... by dmurray on Friday May 05, 2023 @02:28AM (#35825854)
Yes, I wouldn't do it any other way, and it's not the cause of the bug here (except in so far as it didn't contribute to protecting the implementation details by security through obscurity).
[ Parent | on HN ]
Re:Stealing $20M Worth of Magic: The Gathering Cards in a Si... by dontlaugh on Friday May 05, 2023 @07:31AM (#35827893)
There are other ways to do this, but not necessarily simpler:

- explicitly version every change to the store catalogue and require the version to be passed with a purchase, disallowing purchases from old catalogues

- make an expiring signed piece of data (like JWT) for each offer in the store catalogue and require it to be passed back with a purchase, accepting old prices briefly

- make the purchase API two-phase, locking in the price on the first phase and letting the client notice that it changed and potentially neglect to go through with the second phase

[ Parent | on HN ]