Microsoft Account's OAuth tokens leaking via open redirect in Harvest

Re:Microsoft Account's OAuth tokens leaking via open redirec... by tourist2d on Sunday October 22, 2023 @05:55PM (#37979449)

He manages the big bounty program. Why would you think he would be interested in your personal UX issues with the app?

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by andix on Sunday October 22, 2023 @06:46PM (#37979760)

I think you have a wrong impression of the size of the company. According to their website they have 26 engineers in total.

And I would doubt that those are my "personal" UX issues.

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by jorge_leria on Sunday October 22, 2023 @06:54PM (#37979798)

Thank you for your feedback. While my main focus is on Data and Security, I'll ensure that your issues are heard by the team responsible for our mobile app. I'm aware that we're constantly working on improving the iOS app experience.

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by metadat on Sunday October 22, 2023 @07:01PM (#37979850)

I suspect a lot of folks are under the faulty assumption bug bounty guy works for Microsoft.

Apparently Harvest is it's own company, not owned or operated by MS.

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by weird-eye-issue on Monday October 23, 2023 @02:13AM (#37982157)

Exactly. 26 engineers alone. That is way past the size where they are not even close to being part of the iOS team

[ Parent | on HN ]